Trust
Data governance, hosting and residency at MyCustomsInfo®
Customs data is sensitive. Procurement teams, security reviews and regulators all need clear answers before a platform earns access to it. This page is our answer. Four commitments, written plainly, that apply to every MCI tenant from day one.
No data is processed until the correct procedures are in place.
A signed Data Processing Agreement must be executed before any client data enters the platform. Once the DPA is in place and your data is uploaded, reviewed and processed, findings are delivered within hours. This safeguards your organisation, our platform, and the integrity of our data governance, ISO 27001:2022 certification and data security commitments.
The four commitments at a glance
Commitment 01
Hosting in your region
We host across multiple regions. The region holding your data is selected to meet your requirements and the data governance rules that apply in your country or region.
Commitment 02
Jurisdictional residency
Your customs data stays in the legal jurisdiction it belongs to. No cross-region replication for convenience. No exceptions.
Commitment 03
True tenant isolation
Schema-per-tenant database design. Row-level security on every table. Tenant-specific encryption keys. A breach of one tenant cannot expose another.
Commitment 04
ISO 27001:2022 certified
Certificate 513272026. The Annex A controls applicable to our certified scope are recorded in our Statement of Applicability.
Commitment 01
Where your data is held
We host across multiple regions. The region holding your data is selected to meet your own requirements and the data governance rules that apply in your country or region. The specific region for your tenant is stated in your Data Processing Agreement.
The MyCustomsInfo® platform runs on Amazon Web Services. Customer data is held there and nowhere else. Microsoft 365 and Entra ID are used for CustomsPlus® internal business operations and staff identity. They do not hold or process customer data.
Commitment 02
Your data stays in the jurisdiction it belongs to
Hosting region tells you where data lives at rest. Jurisdictional residency tells you which legal regime applies to it. The two are not the same.
MyCustomsInfo® commits to keeping your customs data inside the jurisdictional boundaries it belongs to. We do not replicate, mirror, back up or process your data outside its source jurisdiction for any reason without your explicit written authorisation. The specific region for your tenant is stated in your Data Processing Agreement.
If your procurement team needs more detail: our full Data Processing Agreement is available on request and is mandatory schedule to every MCI Subscription Agreement. Contact us to request a copy.
Commitment 03
Your tenant is isolated from every other tenant
Most multi-tenant SaaS platforms isolate clients with application logic. A breach of the application layer potentially exposes every tenant on the platform. We thought that was the wrong way to design a customs compliance platform.
MyCustomsInfo® isolates tenants at the storage layer. Three architectural commitments enforce this. A breach of one tenant cannot expose any other tenant through any failure mode we have been able to design.
How your data is separated
Customer data is held in Amazon RDS PostgreSQL, with a separate schema for each tenant and row level security applied at the database layer. Documents held in S3 are encrypted with a per-tenant AWS KMS Customer Managed Key.
Tariff reference data is held separately and contains no customer information.
Schema-per-tenant
Every tenant gets its own database schema in our Amazon RDS PostgreSQL database. Your tables, your views, your indexes. No tenant can query across schema boundaries.
Row Level Security
Every table carries a Row Level Security policy enforced by the database engine. Even an application-layer bug cannot read rows belonging to another tenant.
Tenant-specific KMS keys
Every tenant’s data is encrypted with its own AWS KMS Customer Managed Key. A breach of one tenant’s key cannot decrypt another tenant’s data. End of subscription means key destruction, which renders the data cryptographically inaccessible.
How our AI is trained, and what it never sees
Our regime agents are trained on the rules and regulations of a single customs regime. Not on client data. Not on anyone's declarations.
Each client then has an agent that works only against that client's own business rules, for the regimes that client operates in. It sees that client's data and nothing else.
Data is never commingled at either layer. Client data is never used to train any model, in any form, including anonymised.
For your security team
Our ISO 27001:2022 certificate (513272026) and Statement of Applicability are available to procurement teams on request. Schema-per-tenant, RLS policies and KMS key management are documented, and fall within our certified scope as defined in the Statement of Applicability. Request the certificate & SoA.
Commitment 04
ISO 27001:2022 certified
CustomsPlus® has been independently assessed and certified to ISO/IEC 27001:2022 (certificate 513272026). The certified scope, the provision of automated customs technology, compliance services and strategic consultancy to all sectors, explicitly covers the MyCustomsInfo® platform.
Per-tenant data isolation, encryption, access controls and incident response are now independently assessed, not just internally asserted. The table below shows the programme of work that led to certification.
Programme summary
| Programme element | Status |
|---|---|
| Annex A controls recorded in Statement of Applicability | Complete |
| Information Security Management System (ISMS) documented | In place |
| Vulnerability remediation SLAs (Critical 24h, High 7 days, Medium 30 days) | In place |
| Stage 1 audit (documentation review) | Complete |
| Stage 2 audit (operational verification) | Complete |
| Certification awarded | Certificate 513272026 |
Certification awarded June 2026. This page is maintained for transparency. Last reviewed: June 2026.
What happens if something goes wrong
We maintain a documented Incident Response Plan covering security incidents, suspected breaches and service disruptions. The plan classifies incidents by severity (P1 Critical through P4 Low) and sets response times for each.
In the event of a personal data breach affecting your tenant, we notify you and, where required by UK GDPR, the Information Commissioner’s Office within 72 hours. Notification includes the nature of the breach, the categories and approximate number of affected data subjects, the likely consequences and the measures taken in response.
Our incident response procedures are reviewed annually and tested through tabletop exercises. The full Incident Response Plan is available under NDA for procurement security reviews.
Documentation available on request
Data Processing Agreement
UK GDPR Article 28 compliant. Mandatory schedule to every MCI Subscription Agreement. Available for review during procurement.
Request DPA →Sub-processor list
Complete list of organisations that may process client data on our behalf, with their location, purpose and security commitments.
Request list →ISO 27001:2022 certificate & Statement of Applicability
Our ISO 27001:2022 certificate (513272026) and Statement of Applicability, recording the Annex A controls applicable to our certified scope. Available to procurement teams on request.
Request certificate & SoA →Questions from your security or procurement team?
We respond to security questionnaires, RFI documents and procurement reviews directly. The fastest route is email. We aim to respond to security questionnaires within five working days.
Contact us →Or call us on +44 151 808 0103.
This page describes the data governance, hosting and residency commitments that apply to MyCustomsInfo® tenants provisioned from the date of publication forward. Last reviewed 17 August 2026. The substantive commitments are contractually formalised through your Data Processing Agreement and MCI Subscription Agreement; this page is a plain-English summary of those commitments and not a substitute for them.
MyCustomsInfo® is operated by CustomsPlus Limited, registered in England and Wales, Company No. 12327750. Registered office: Cholmondeley House, Dee Hills Park, Chester, CH3 5AR, United Kingdom.