TLS 1.2+, AES-256, bcrypt
AWS Zurich & Frankfurt; firewall and hardened environments
RBAC, least privilege, MFA
Daily encrypted backups, 30-day retention
24/7 alerts, log review
Formal process, 72-hour breach notification
Contracts and assessments for all providers