Business Standard and Business Premium include a data processing agreement (DPA). Sign it with one click on the admin page and keep a copy for your records.
The DPA points to our list of subprocessors and gives you 30 days' notice of changes. Where your data is stored is listed on infopeak.io/responsibility.