Security and data handling

What a vendor review asks for, with the numbers: where statements are stored, how they are encrypted, when they are deleted, which companies process them, and what we do not have yet.

Last updated Oct 1, 2026. Questions go to [email protected].

Summary of security facts, each with its status
In place today:	Encrypted in transit	TLS 1.2 or newer on every connection.	Storage and encryption
In place today:	Encrypted at rest	AES-256, plus a key the application holds on every stored statement, so the storage bucket alone cannot be read.	Storage and encryption
In place today:	Where data lives	Servers and database in the Netherlands, statement files in Cloudflare's EU storage. Pages are read by Anthropic in the United States.	Subprocessors
In place today:	Never used to train models	Not our models and not Anthropic's. No customer statement is ever in our accuracy test set.	Data processing agreement
In place today:	Deleted on a schedule	24 hours after upload without an account. 7 days for a firm by default; the owner picks 1, 7 or 30. Backups overwritten after 30 days.	Retention schedule
In place today:	DPA signed in the account	The firm's owner signs the data processing agreement in Settings. No email, no call.	Data processing agreement
Not in place yet:	No SOC 2 report yet	Instead: a CAIQ v4 self-assessment in the CSA STAR registry, and every control listed on this page.	SOC 2
In place today:	Incident notice	Within 24 hours of discovery, to every affected firm.	Incidents

: In place today
: Not in place yet

Storage and encryption

A statement is held only for the retention window below; after that we keep the rows we read from it. Each step below names the company that holds the data, and each period ties out to the retention schedule and the subprocessor list that follow.

Where a statement goes, who holds it, how it is protected and for how long
Check	Step	Where	Holds	Protection	Until
No stored copy of ours to check	Upload	Cloudflare edge, global	The PDF, in transit	TLS 1.2 or newer; a signed upload link that expires within minutes	The upload ends
Ties out to the retention schedule	Stored	Cloudflare R2, EU	The PDF	AES-256 plus our application key; no public address	24 hours without an account; 1, 7 or 30 days for a firm, 7 by default
No stored copy of ours to check	Read	Our reader on Railway, Netherlands, then Anthropic, United States	Page images	TLS 1.2 or newer; an outbound allowlist; never used for training	Our reader: until the page is read. Anthropic: its own API data terms
Ties out to the retention schedule	Kept	Railway, Netherlands	Rows, corrections, exported files	AES-256 at rest; access by firm role	Until the firm deletes the conversion or the organization
Ties out to the retention schedule	Recorded	Railway, Netherlands	Download record and audit log: ids and counts, no content	AES-256 at rest; the owner and admins read it, members see their own actions	12 months
Ties out to the retention schedule	Backed up	Cloudflare R2, EU	Database copies: rows and records, no PDFs	AES-256	30 days, then overwritten

: Ties out to a row of the retention schedule
: In transit or being read, no stored copy of ours

Statements are never used to train models, ours or anyone's. Our accuracy figures come from synthetic and bank-published test statements; no customer statement is ever in the test set.

Retention schedule

How long each kind of data is kept, and who can change it. Deleting a conversion or the organization removes its data from the live system at once; backups that hold it are overwritten within 30 days.

Retention schedule
Data	Kept for	Who can change it
Statement uploaded without an account	24 hours	Nobody. Signing up within 24 hours moves it to the firm.
Statement uploaded by a firm	7 daysby default	The firm's owner: 1, 7 or 30 days

Signed-in owners set the upload window in Settings, Retention. Data is never deleted because a payment failed.

Subprocessors

Five companies process data for us. Statement content reaches three of them: Railway runs our servers and database, Cloudflare stores the file encrypted and Anthropic reads the pages. Stripe and Resend never receive a statement.

Subprocessors, last updated Oct 1, 2026
Company	Purpose	Receives statement content	Location
Railway	Application servers and database	Rows, and the file while our reader works on it	Netherlands (EU)
Cloudflare	Network edge, DNS, encrypted statement storage (R2)	The file, encrypted with our key	EU storage, global edge
Anthropic	Reading statement pages with a vision model, no training on your data	Page images of each statement	United States
Stripe	Subscription billing and card payments	No	United States and EU
Resend	Sign-in and notification email	No, email addresses and our email text only	United States

Last updated Oct 1, 2026.We email every firm owner 30 days before we add a subprocessor.

Sign-in and roles

There are no passwords to steal, reuse or reset. A firm decides who is in it and what each person can do.

Ways to sign in: An emailed link that works once and expires after 15 minutes, Google, Microsoft (Entra ID), or a passkey.
Two-step verification: An authenticator app or a passkey, with single-use recovery codes. A firm's owner can require it for everyone.
Session limits: Signed out after 60 minutes idle and 12 hours at most. On a device you mark as your own, with a second factor: 30 days, or 7 days idle. On a shared computer the session ends when the browser closes.
Signing out: Ends the session on our servers, not only in the browser. Removing a member ends their sessions at once.
Sensitive changes: Billing, members and roles, bulk export, two-step settings and deleting the organization need a sign-in from the last 15 minutes.
Limits: 3 sign-in links per address in 15 minutes and 10 a day; after 5 wrong codes in a row, 30 seconds before the next try. The reply is the same whether or not an address has an account.
Evidilo staff: Our operations console shows run ids, bank, page count, timing and error codes, never statement content. Staff see a firm's conversions only after its owner turns on support access in Settings.

Four roles

What each role can do
Role	Can do
Owner	Everything, including billing, the DPA, retention, deleting the organization and transferring ownership. Exactly one per firm.
Admin	Invite and remove members, set roles below owner, change conversion settings, read the audit log. Not billing, not deletion.
Member	Convert, review and download the firm's statements. Reads the audit log for their own actions.
Viewer	View and download only. No conversions, no member management.

What we record, and what we never record

Logs and the audit trail say who did what and when, with ids and counts. They never carry what a statement says.

Recorded

Sign-ins, failed sign-ins and ended sessions
Member, role and settings changes
Each upload, view, download and export: who, which file, when
Each reading run: run id, bank, page count, timing, result, error code

Never recorded

Statement content or transaction rows
Account numbers or card numbers
Session, sign-in link, Google or Microsoft tokens
Two-step codes, their secrets and passkey private keys
The body of an upload request

The download record and audit log are kept 12 months. The owner and admins read them in Settings, Audit log; members see their own actions.

Data processing agreement

Under the FTC Safeguards Rule, a US tax or accounting firm must require its service providers, by contract, to keep safeguards for customer information: 16 CFR 314.4(f). Our data processing agreement (DPA) is that contract. It also covers our duties as the processor of your clients' data, breach notice, and deletion when the agreement ends.

How to sign it, without email

Your firm already uses Evidilo

The firm's owner opens Settings and signs. Evidilo has signed already, so the owner's signature completes it, and the signed PDF stays in Settings to download.

Sign the DPA in Settings

Not a customer yet

Create your firm's account. The DPA comes with every paid plan and can be signed before anyone uploads a client's statement.

Create your firm's account

What it says

A summary of the seven clauses, not the legal text. The full agreement opens in Settings before you sign; to read it first, write to [email protected].

Instructions: Your firm decides what is processed. We process statements only to convert them for you and keep the records your settings ask for.
Safeguards: We keep the controls on this page in place while we hold your data: encryption, access control, two-step verification, logging, and a written information security plan with a named owner, reviewed every year. This is the clause the Safeguards Rule asks your contract to contain.
Subprocessors: Only the companies listed above, and 30 days' notice by email to the firm's owner before we add one.
Breach notice: Within 24 hours of discovering an incident that affects your data, we tell your firm what happened, which data, and what we are doing.
No training: Your statements are never used to train models, ours or a subprocessor's.
Deletion: Statements are deleted on the schedule above. When the agreement ends, we delete your statements, rows, files, members and invitations at once; backups that hold them are overwritten within 30 days. Billing records stay as long as tax law requires.
Questions from your review: We answer them in writing from [email protected].

SOC 2

Evidilo does not have a SOC 2 report, and no SOC 2 audit is under way.

A SOC 2 Type II report is an independent CPA firm's opinion on how controls worked over an observation window of 3 to 12 months, and a first report takes 6 to 15 months to produce. We have not started that window. Instead we publish the controls themselves, so a reviewer can check each one before a first call.

What exists instead is our CAIQ v4 self-assessment in the CSA STAR registry. CAIQ is the Cloud Security Alliance's Consensus Assessments Initiative Questionnaire; the self-assessment is our own answers to it, and no auditor has checked them. Find Evidilo in the CSA STAR registry

What a vendor review can get from us today

Documents available for a vendor review
Document	Where
This page, with the retention schedule and the subprocessor list	Public, no account
CAIQ v4 self-assessment	CSA STAR registry, public
Data processing agreement with the Safeguards Rule terms	Settings, signed by the firm's owner
Download record and audit log for your firm	Settings, read by the owner and admins; members see their own actions
Written answers to your own security questionnaire	[email protected]

Not available yet: a SOC 2 report, an ISO 27001 certificate, a third-party penetration test. If your review requires one, write to [email protected]. A penetration test would come first, because it can be shown long before a SOC 2 report exists.

Incidents and vulnerability reports

Incident notice: Within 24 hours of discovering an incident that affects a firm's data, we email the firm's owner: what happened, which data, what we have done and what you should do.
Written information security plan: Owned by Jakub Zavada, founder, and reviewed every year. It covers access, encryption, retention, subprocessors and how we respond to an incident.
Report a vulnerability: Write to [email protected] with the steps to reproduce it. Test only against your own firm's account; do not open other firms' data or slow the service down.
Personal data requests: [email protected]