Where is our data hosted, and who can access it?
BestPair stores and processes your data on Amazon Web Services in the United States, in its production environment only, and it is not stored outside the United States. Only named BestPair staff who need it for your project can reach it. The founder and R&D team are in Australia and may access it remotely, only from company-managed devices and under the same controls.
New to BestPair? See what it is and how it works
Where your data is stored and processed
Your data is stored and processed in the United States, in Amazon Web Services data centres located there. It is not stored outside the United States. That is the same place the matching is calculated: off-site, by BestPair, and never inside your own environment or your dialer.
Inside BestPair, client data is processed only in the production environment, which is the environment covered by BestPair’s SOC 2 Type 1 report. It is not copied to development, test or research environments. Production is isolated, and administrative access goes over a private network.
Files reach that environment by encrypted SFTP to a folder BestPair provides, never by email. Data is encrypted in transit (TLS 1.2 or higher, and SFTP) and at rest (AES-256). What the files contain is pseudonymised account and call data, and what BestPair never asks for is set out on its own page.
Who can access it, and from where
Storage and access are separate questions, and the answers differ:
| Question | What the Security Overview says |
|---|---|
| Who can reach the data? | Only named BestPair staff who need it for your project |
| From where? | The data is stored and processed only in the United States. The founder and R&D team are in Australia and may access it remotely, only from company-managed devices and under the same controls |
| How is access controlled? | Least privilege and unique accounts. The full controls are in the Security Overview, available on request |
| What about passwords? | A company password manager, with no shared credentials |
| What about devices? | No client data on personal devices. Company devices are encrypted and locked |
| Is access recorded? | Access to client data is logged, the logs are kept for twelve months, and alerts are reviewed |
| What do staff sign? | All staff sign confidentiality agreements and complete security training every year |
Who else handles it
Amazon Web Services, Inc. is BestPair’s only sub-processor, for hosting, storage and processing, in the United States. BestPair gives your agency at least 30 days’ notice by email before adding or replacing a sub-processor, and your agency may object on reasonable data protection grounds within that period. If the objection cannot be resolved, your agency may end the affected services. BestPair keeps a written contract with each sub-processor that protects the data at least as well as the Data Processing Addendum, and stays responsible for its performance.
BestPair does not sell or share the data, use it outside the service, or try to re-identify any consumer.
If something goes wrong
BestPair notifies your agency without undue delay, and within 72 hours, after confirming a security incident affecting your data. The notice says what happened, the data and individuals affected where known, the steps taken and who to contact, and BestPair updates you as more is learned. For protected health information, BestPair reports within five business days of discovery, under the Business Associate Agreement. BestPair does not notify consumers, regulators or your clients on your behalf without your consent, unless the law requires it.
How long it stays
BestPair keeps your data only for the engagement. Within 30 days after it ends, or sooner if you ask in writing, the data is deleted from active systems and the deletion is confirmed in writing. Backups roll off within 90 days and stay protected until then. What happens to the data and the models at contract end.
The Security Overview, the Data Processing Addendum and the SOC 2 Type 1 report (under NDA) are available on request, and what a security review asks covers the rest of a vendor questionnaire.
Common follow-up questions
Do staff outside the United States access our data?
They may. The founder and R&D team are in Australia and may access data remotely, only from company-managed devices and under the same controls as everyone else. The data itself is stored and processed only in the United States, in AWS data centres located there.
Can our data be kept in Canada or another country?
BestPair’s documents provide for storage and processing in the United States, on AWS. If a client contract requires account data to stay in another country, raise it on the fit call, before anything is signed.
Can we check the controls ourselves?
Once a year, on request, BestPair provides its SOC 2 report under confidentiality and answers a reasonable written security questionnaire. If those do not address a specific concern, after a security incident, or if a regulator requires it, your agency may audit once in any twelve-month period, on at least 30 days’ notice and at its own cost.
Does the matching run inside our dialer or our own environment?
No. The matching is calculated off-site by BestPair, in its production environment on AWS in the United States. Files arrive by encrypted SFTP to a folder BestPair provides, never by email.
What it could mean on your floor
Two minutes
Watch the explainer
What your dialer does with the next account, what pairing changes, and what the Floor Assessment measures. With captions.
Watch the videoYour floor
Try the calculator
Four numbers off your dialer and collections reports give an illustrative figure for your floor. It is at best informed guesswork until your own history is measured.
Open the calculatorA live test
Read the case study
170,000 telecom accounts split at random before the first call, and how the result was counted.
Read it
Would it be a bad idea to spend 45 minutes finding out?
If your shop does not qualify, you will hear it on the call, not after you have paid for a report.
Book a 45-minute fit call