Trust and security

Where data lives

Data residency

Some universities must keep data in their own country. Oxonia offers in-country hosting as an add-on for them.

About this page

Last updated: 10 October 2026.

This page describes how the Oxonia platform is designed to work. It is not a certification or an audit report. Our contractual commitments are in each university's order form, the data processing agreement and the service level agreement.

Default hosting

By default, Oxonia stores university data in a hosting region chosen by Oxonia Academy. Our current hosting location is [Hosting location]. The order form and the data processing agreement record where each university's data is held.

In-country hosting

Universities that need their data kept in their own country can choose in-country hosting. It is an add-on priced at 15% on top of the subscription. It is listed with the other add-ons on the pricing page.

In-country hosting depends on the hosting providers available in each country. We confirm in writing what is possible for your country, and what stays in country, before you sign. Ask about your country when you book a demo.

Why universities ask for it

  • A national law or regulator requires certain data to stay in the country.
  • A ministry or funder sets data residency as a condition.
  • The university's own policy prefers local hosting for exam and student records.
  • Council wants a clear answer to the question: where is our data?

What in-country hosting covers

The scope of in-country hosting, such as which data stays in country and which supporting services may run elsewhere, will be agreed in writing and recorded in the data processing agreement. Where Ai enabled features rely on services outside the country, this will be stated plainly, together with the safeguards in place. Universities that connect their own AI keys choose their own AI service; see Bring your own AI keys.

Moving data between countries

Where personal data leaves the country it was collected in, the data processing agreement sets out the legal basis and safeguards. See Data protection and Sub-processors.

Questions to settle before you sign

Which data must stay in country? Agree this with your data protection officer and, where relevant, your regulator.

Do backups stay in country too? Backup locations will be set out alongside hosting. See Backups and recovery.

Does it change features? The aim is that every product works the same way. Any exception will be stated before you sign.

Related