Where your data lives

Region

Your store’s data is held in Microsoft Azure, Germany West Central.

CIQRA does not move store data between regions. If that ever changes for a specific capability, it will be named on this page before it happens rather than after.

Database

The store database is a PostgreSQL 17 Flexible Server.

PostgreSQL matters here for a reason that is not branding: it lets isolation between stores be enforced by the database rather than only by application code. How that is done, and how much of it is covered, is on How stores are kept apart.

Compute

The database runs on a Standard_D2ds_v5 instance in Azure’s GeneralPurpose tier, in a zone-redundant configuration. The redundancy part is covered in Availability & recovery, because a configuration that has never failed over is a claim rather than a capability.

How these were established

Statement	How it was measured	When
Germany West Central	Read from the Azure resource itself	9 August 2026
PostgreSQL 17 Flexible Server	Read from the Azure resource itself	9 August 2026
Standard_D2ds_v5 / GeneralPurpose	Read from the Azure resource itself	9 August 2026

These are readings of a live resource on a stated date, not a design document. A design document says what someone intended; a reading says what is actually running.

Encryption at rest

Surface	Measured
Store database	Encrypted, with platform-managed keys (no customer-managed key is configured)
Database storage	Azure managed premium disk
File / media storage	Encryption enabled, minimum TLS 1.2 for connections

Read on 9 August 2026 from the resources themselves.

What sits in front

Traffic to CIQRA passes through Cloudflare — confirmed from live response headers, not from a diagram.

We are not claiming a web application firewall

A proxy in front of a service and a WAF rule set actually enforcing rules are two different statements, and only the first one has been measured. There is no Azure-side WAF resource in CIQRA’s production group, and whether a Cloudflare rule set is enabled has not been verified.

So: traffic passes through Cloudflare; WAF rule-set configuration is outside the scope of this statement. We are aware that reads as a gap rather than a feature. It is one, and it is under review — but until it is measured, “WAF protected” is a sentence we are not entitled to write.

What this page does not say

• It does not claim any certification for CIQRA. Certifications held by Microsoft for Azure’s data centres belong to Microsoft. Repeating them here as though they were ours would be exactly the kind of borrowed assurance this section exists to avoid.
• It does not state an HTTPS-only enforcement setting for file storage. That specific setting was read as unset — not off, unset — which is a finding we are following up rather than a claim we can make in either direction.