At a high level, all data is encrypted in transit and at rest.  We use Web Application Firewall based on geolocation.  We scan our infrastructure on a weekly basis to identify vulnerabilities and we apply urgent software updates as soon as we are made aware of them either though scanning or notifications from Oracle.  We apply all other routine patches and updates from Oracle on a regular basis.  Our Cloud Provider is Oracle Corporation and data is stored at their data centre in Reston Virgina.  Data is also protected by Oracle Database Autonomous Recovery Service which provides real time back up and utilizes zero loss database technology.  We use OCI and Oracle's cloud compliance attestations can be found at https://www.oracle.com/corporate/cloud-compliance/#attestations