Indesign Publish Online

Hi all, please can I have some help? I am creating Publish Online documents for a client with sensitive data and their "Trustees are concerned about data security, and might be concerned that their content was being hosted by a third party who aren’t subject to GDPR constraints. If we assume that there is some data in the newsletter (such as the name of a trustee and mention of their health) then we’d need to be able to know how the data security worked. Where is the data held? And who is the legal agreement between that allows data to be held by that entity?"

Does anyone have any helpful response and information regarding this?

Any help would be appreciated.