Certifications
What we hold, where data lives, who can see it, and what we will never do with it.
Daysium is Cyber Essentials certified, with information security controls mapped to ISO 27001:2022 and working towards certification.
Regulatory and data protection standing
Daysium is a trading name of Days Limited, registered with the Jersey Financial Services Commission under number 149158. The registered office is 1-3 La Colomberie, St Helier, Jersey, JE2 4QB. Days Limited is not regulated by the JFSC, and Daysium does not give financial or tax advice.
Data protection is governed by the Data Protection (Jersey) Law 2018 and regulated by the Jersey Office of the Information Commissioner. Jersey holds EU adequacy. Our privacy and data-handling arrangements are designed to meet the requirements that apply to us under Jersey law and, where relevant, UK and EU data-protection rules.
We operate a documented breach procedure, and notify the Information Commissioner and affected individuals in line with the law.
Where data lives
Your day-count history and the evidence you upload are hosted on Google Cloud Platform in the United Kingdom and encrypted at rest. Google Cloud encrypts customer content at rest by default, and Google Cloud’s ISMS is certified to ISO/IEC 27001.
Location data is never sold. Access is permission-based.
Some supporting functions — sign-in, notifications, email and customer support — are provided by established international providers that process limited data in the United States, under Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. System logging is provided from within the European Union. A full list of sub-processors, what each does and where data is held, is available on request.
Daysium is the data controller for its own account data. Where a client uses Daysium alongside an advisor, family office or trust firm, that firm is separately a controller in its own right. Our privacy policy sets out how personal data is handled.
Automated processing
Daysium makes no automated decision about your tax position. The platform records days and applies the configured rules. Which tests apply and what the result means remain matters for you and, where appropriate, your advisor.
Where processing is carried out by a sub-processor, it is under contract and limited to delivering the service.
Access and the record
Access is permission-based, and every grant is made by the person whose data it is. An invited advisor sees the live day-count position and reports, not the underlying location history or evidence files.
Capture metadata is preserved, and changes to the record are written to the audit log: what changed, when and by whom.
11 September 2026
