At TheyDo we use a secure cloud infrastructure based on AWS. Cloudflare is used by TheyDo as DDOS protection service and Web Application Firewall.
Subcontractors/vendors are vetted to make sure that they use the same level of protection that we hold ourselves to. A list of subprocessors that we use can be found here.
At TheyDo, we maintain an overview of all security practices, subcontractors, and other services that we use. We make regular backups of our server states.
