# Where your data lives.

- Canonical URL: https://www.broadnet.me/security/data-residency
- Language: en
- Publisher: BroadNet (https://www.broadnet.me)
- Markdown version of the page above, generated from the rendered page.

SECURITY

Last updated · April 02, 2026 Control owner · Security Engineering Document · /security/data-residency

On this page

Disclose a vulnerability

Responsible-disclosure safe harbour for good-faith research.

[Report securely](mailto:security@broadnet.me)

## Overview

BroadNet supports MENA-resident, EU-resident, US-resident, and Singapore-resident data hosting depending on customer requirement. The default is MENA-resident. Cross-border transfers governed by EU SCCs + region-appropriate addenda.

§01

## Definitions

Security terminology used on this page is defined below. Cryptographic and incident-response terms follow NIST SP 800-53 Rev. 5 and ISO/IEC 27001:2022 vocabularies where applicable.

Quick reference

**Data residency**

The geographic region in which a customer’s data is stored at rest. Distinct from data sovereignty.

**Sub-processor**

A third party engaged by BroadNet to process personal data on behalf of customers.

**Confirmed breach**

A security event verified by Security Engineering as involving unauthorised access to or loss of customer data — triggering the 72-hour clock.

**Encryption at rest**

AES-256-GCM applied to all persistent storage. Keys managed via HSM-backed KMS with quarterly rotation.

## Questions?

Reporting a vulnerability, requesting a SIG/CAIQ, or asking about a control? Our security team triages within one business day.

[security@broadnet.me](mailto:security@broadnet.me)

For non-security correspondence, email legal@broadnet.me.

Related documents

## Continue reading

[All security documents](https://www.broadnet.me/security)

[Document Breach notification](https://www.broadnet.me/security/breach-notification) [Document UAE PDPL for SMS & WhatsApp marketing (2026 guide)](https://www.broadnet.me/blog/uae-pdpl-sms-whatsapp-marketing-2026)