Where is our data held, and is it backed up?

In the United Kingdom, on hardware we control, encrypted at rest. Per-client credentials — such as the client secret for a directory connection — are separately encrypted before they are stored, so they are not readable even from the database.

Backups run hourly, encrypted to a key that the machine taking the backup cannot itself read, and they are copied off-site. A restore is rehearsed automatically once a week on the second host: a real backup is fetched, decrypted, restored, every table compared, and a real sealed key opened — because a backup that restores into something complete and unusable is the failure mode that only shows up on the day you need it. When that drill last passed is on the admin Backups page.