"Where is our data, and who can see it?"

• The hosted service runs in the European Union, on Amazon Web Services in Ireland.
• Organizations cannot see each other. Isolation is enforced by the database's row-level security, not by application code alone.
• Operator access is limited and recorded. Inside the application, the operator of the service can look into an organization only through a "view as" session: read-only, as a member it chooses, for at most an hour, marked with a banner, and recorded in your organization's audit log.
• Self-hosting puts your data wherever you run it.