Always encrypted
Encrypted connections and, if you keep files, AES-256 encryption with a different key for each account.
Security
Security and compliance, explained without the small print.
Encryption at every step, infrastructure in the EU, a record of reviews and a data processing agreement ready to download.
Infrastructure in the EU
Servers in Spain and stored data in the EU. AI analysis is carried out by Cloudflare Workers AI, which does not keep the documents or train on them; the sovereign profile uses European providers only.
Audit trail
Every review decision is recorded with who made it, when and why.
GDPR
We act as a data processor, with minimum data and no copies by default, in line with the data minimisation principle.
Access controls
Team roles
Owner, administrator and developer, each with their own permissions.
Separate keys
Test and live keys, plus publishable keys restricted to your domains.
Signed notifications
Every notification we send to your system is signed so you can check that it comes from us.
Documentation for your legal team
- Data processing agreement (DPA)Downloadable, with the list of subprocessors. On the Enterprise plan, signed and tailored.
- Published subprocessorsIONOS (servers in Spain), Cloudflare (AI analysis, and storage in the EU if you turn it on) and Stripe (payments). With the sovereign profile, European providers such as AWS in Frankfurt, Google Cloud in the EU or Mistral.
- Privacy policyWhat we process, why and for how long.
- What we do not doWe do not use biometrics or certify that a document is authentic. We give you signals so you can decide.
Frequently asked questions
Where are documents processed?
Our servers are in Spain and the data you keep is hosted in the EU. By default, AI analysis is carried out by Cloudflare Workers AI on its network, without keeping the documents or training on them. With the sovereign profile, the analysis is done with European providers only.
Can you sign our data processing agreement?
On the Enterprise plan we sign a tailored DPA. On the other plans, you can download ours.
What happens if there is a security incident?
We notify you without undue delay, as the GDPR requires and the DPA sets out.
And for the record…
Create your free account and validate your first document in five minutes. No card required.