EU Data Residency and Processing
Where Holofin processes and stores document data, which providers handle it, and what leaves the European Union: only aggregated service metrics, never document content.
Data Boundary Guarantee
Holofin guarantees that all customer document data is processed, stored, and deleted exclusively within the European Union. This applies to:
- Document ingestion and upload
- Temporary storage during processing
- AI/ML computation and extraction
- Result storage and retrieval
- Data deletion workflows
EU Regions Utilized
Document data is processed only in these EU regions:
| Provider | Regions | Purpose |
|---|---|---|
| Google Cloud Platform | Belgium (europe-west1), Netherlands (europe-west4) | AI/ML processing |
| Hetzner | Falkenstein, Germany (FSN1) | Compute, hosting, Kubernetes cluster |
| Cloudflare | European Union data centers | Object storage (R2), CDN, security |
| PostHog | European Union data centers | Product analytics |
Data Retention and Deletion
- Default Retention:Documents and extracted data are retained for 30 days by default.
- Configurable Periods:Organizations can configure custom retention periods (ZDR, 30, 60, 90 days, or indefinite) through account settings. ZDR (Zero Data Retention) deletes source documents within 24 hours of processing.
- Immediate Deletion:Organizations can request immediate deletion of specific documents via the API or dashboard at any time.
- Automatic Cleanup:Automatic, secure deletion occurs after the retention window expires. No backups or long-term archives containing customer data are maintained beyond the retention period.
Encryption Standards
- At Rest:All data encrypted using AES-256 encryption.
- In Transit:TLS 1.2+ (TLS 1.3 preferred) for all API communications.
- Key Management:Google Cloud KMS with automatic key rotation every 12 months.
Subprocessor Transparency
Only the subprocessors in the first table receive document content, and all of them process it in the EU.
Document-Processing Subprocessors (EU-only)
| Company | Purpose |
|---|---|
| Google Cloud Platform | AI/ML processing (EU regions only) |
| Hetzner Online GmbH | Dedicated compute, Kubernetes orchestration (Falkenstein, Germany) |
| Cloudflare, Inc. | Object storage, CDN, security (EU regions only) |
Vendors Receiving Only Operational Telemetry
The following vendors receive only aggregated, anonymous service-level metrics and never receive document content:
| Company | Purpose |
|---|---|
| PostHog, Inc. | Product analytics (EU hosted) |
Request EU Data Residency Guarantee
For formal documentation of our EU data residency commitments or to discuss specific requirements, please contact us:
- Security and Compliance:
- Data Protection Officer: