Data Policies and Compliance

The documents you send us are bank statements, payslips, tax forms and identity documents. This page covers where we store them, how they are encrypted, which subprocessors see them, and how one customer's data is kept apart from another's.

Data Storage

• Storage Location:
  Documents and extracted data are stored in Cloudflare R2, in European Union data centers.
• Access Permissions:
  Stored data is reachable only through authenticated API requests scoped to your organization, and through authorized internal processes.
• Data Retention:
  Documents and extraction results are retained for 30 days by default. Organizations can configure custom retention periods (ZDR, 30, 60, 90 days, or indefinite). ZDR (Zero Data Retention) automatically deletes source documents within 24 hours of processing. Data older than your retention period is deleted automatically.
• Data Usage:
  Your documents are never shared with third parties. We never use customer documents to train our AI models.

Encryption

• Encryption at Rest:
  All documents and extracted data are encrypted at rest using AES-256 encryption. Without the keys, stored data is unreadable.
• Encryption in Transit:
  All API communications are encrypted using TLS 1.2+ (with TLS 1.3 preferred).
• Key Management:
  Encryption keys are managed in Google Cloud KMS with automatic key rotation at least once every 12 months.

Compliance

• GDPR Compliance:
  We comply with the General Data Protection Regulation (GDPR) for EU data subjects. Holofin acts as both a Data Controller and Data Processor depending on the context of data processing.
• Data Processing Agreement:
  A Data Processing Agreement (DPA) is available for organizations requiring formal data processing agreements. Contact us to sign a DPA.
• EU Data Residency:
  All data is processed and stored exclusively in European Union data centers. We can provide guarantees for EU-only data processing upon request.

Authorized Subprocessors

The following third-party services are authorized to process data on behalf of Holofin:

Infrastructure

Analytics

Data Isolation

• Logical Isolation:
  Each organization's data is logically isolated from other customers. API keys are scoped to your organization and cannot access data from other accounts.
• Staff Access:
  Holofin staff access to customer data is strictly limited, audited, and only performed when necessary for support or troubleshooting with your explicit consent.

Contact

For questions about these policies, or to sign a DPA, contact us:

• General Inquiries:
  [email protected]
• Security and Compliance:
  [email protected]