Most security pages are a wall of logos. This one is written so that every sentence can be verified, including the parts where the honest answer is narrower than a badge.
Those are two different claims and we keep them apart deliberately. The Good Foundry operates to ISO 27001-aligned controls; our hosting provider holds independent ISO 27001 certification; our billing sub-processor is SOC 2 audited. The Good Foundry does not itself hold ISO 27001 or SOC 2 certification, and you should assume any vendor whose page is less specific than this is telling you the same thing less clearly.
If your review needs certification rather than alignment, tell us early. It changes what we can sign, and finding that out at contract stage helps nobody.
At the SiteGround Tier-1 data centre closest to your country. Regions include Sydney, Singapore, Iowa, London and Frankfurt, and residency can be locked to a single region under your contract. The nightly encrypted backup is held in Australia. It is a full database snapshot, retained on a daily, weekly and monthly cascade.
We say where the backups go because it is the question that separates answers. A residency claim that covers only the live system is not a residency claim.
Cohort reporting is suppressed below a minimum number of responses, so a small team cannot be identified from a result. That is how the reporting works rather than a setting an administrator has to remember to switch on.
Where an organisation can reach an individual record at all, it is a separately enabled choice rather than a default, because a counsellor's legitimate need and an always-on capability are not the same thing.
Every third party that can touch data is listed with what it can see and in which region, separated into those engaged on every deployment and those engaged only when you contract a Power-Up. The list carries a version and a changelog, so you can see what changed and when.
Send the questionnaire. If it is framed against ISO 27001, SOC 2, Essential Eight, IRAP, NIST CSF or GDPR we will answer in that structure.