Security and Privacy

How Holofin encrypts, retains and isolates your documents, the controls available on API keys, and how to report a vulnerability.

Data Protection

Data is encrypted in transit and at rest.

Protection	Description
TLS 1.3 Encryption	All API communications are encrypted using TLS 1.3.
Encryption at Rest	All stored documents and extracted data are encrypted at rest using AES-256 encryption.
Secure Key Management	Encryption keys are held in a key management service and rotated regularly.

How long documents and results are kept, and how to delete them sooner.

Default retention:
Documents and extraction results are retained for 90 days by default.
Configurable retention:
Organizations can configure custom retention periods: ZDR (Zero Data Retention), 30, 60, 90 days, or indefinite storage.
Zero Data Retention (ZDR):
ZDR deletes source documents within 24 hours of processing. Only extracted results are retained.
Immediate deletion:
You can delete documents and results at any time via the API or dashboard.
Automatic cleanup:
Expired data is deleted automatically according to your retention policy.

Controls available on API access.

Feature	Description
API Key Authentication	API keys with configurable permissions, revocable at any time.
Rate Limiting	Configurable rate limits per API key.
IP Allowlisting	Restrict API access to specific IP addresses or CIDR ranges per API key.
Key Expiration	Set expiration dates on API keys to enforce automatic rotation and limit exposure.
Audit Logging	Logs of all API activity, for security monitoring and compliance.

Regulatory commitments and contractual documents.

GDPR:
Compliant with the General Data Protection Regulation for EU data subjects.
Data Processing Agreement:
DPA available for organizations requiring formal data processing agreements.
EU Data Residency:
All data is processed and stored in European Union data centers.

Your data privacy is a core priority.

No data sharing:
Your documents and extracted data are never shared with third parties.
No training on your data:
Your documents are never used to train our AI models.
Data isolation:
Each organization's data is logically isolated from other customers.
Minimal data access:
Holofin staff access to customer data is strictly limited and audited.

We recommend the following practices when integrating with the Holofin API:

Rotate API keys regularly:
Generate new API keys periodically and revoke old ones. Set an expiration date when creating keys to enforce automatic rotation.
Use environment variables:
Never hardcode API keys in your source code.
Use IP allowlisting:
Restrict API keys to known IP addresses to prevent unauthorized access. Configure in Settings → API Keys.
Limit key permissions:
Create API keys with only the permissions needed for each use case.
Monitor API usage:
Regularly review your API logs for unusual activity.
Use webhooks securely:
Validate webhook signatures to ensure authenticity.

To report a vulnerability or a security concern, contact us: