Because the data is on your server, in your environment, and your network, it falls under your security policies.
DotActiv adheres to your security policies. If you give DotActiv a dedicated VPN with full-time access, DotActiv treats it with the utmost respect. Access is only available for the authorised users.
If you decide that DotActiv can only get access on request, by VPN with someone supervising, DotActiv complies.