The program is hosted by Microsoft Azure servers located in Microsoft Data Centers around the United States. In addition to employing our own WAF (Web Application Firewall - Microsoft Azure - Web Application Firewall) we also utilize security measures provided by Microsoft and encryption to sensitive data located within the database itself.
To read more about Microsoft's security measures that they take at their data centers: https://docs.microsoft.com/en-us/azure/security/fundamentals/overview
This article and all of it's sub-articles are Microsoft's documentation on everything from physical security of their data centers, to infrastructure, network and data integrity.
Backups: The program employs through Microsoft Geosynchronous Replication (https://docs.microsoft.com/en-us/azure/azure-sql/database/active-geo-replication-overview) , meaning as you work in your practice, the data that you enter and/or manipulate is getting written to the database you're on, as well as synced to another backup database across the continent.
The program will also continue to monitor things that could potentially affect it, work hand in hand with it's Microsoft partners, and we will continually update it's own security to be in line with industry standards.