Certifications and external testing
- SOC 2 Type II — None
Not held. We answer questionnaires with the controls below and the evidence in our code.
- ISO/IEC 27001 — None
Not held.
- 외부 침투 테스트 — None
No third-party test has been carried out. Automated checks in our repository — missing auth, security headers, leaked secrets, dependency vulnerabilities — run on every deploy.
Retention periods
- Activity logs, share access logs, investor activity — Set by each company. 0 means indefinite; any other value is clamped to between 30 and 3,650 days (Settings → Data governance).
- Usage and bandwidth events — Automatically deleted after 400 days (database TTL).
- Share sessions, data room permits, email verification codes — Deleted automatically at their expiry time.
- API tokens — Automatically deleted 90 days after expiry (kept until then for investigation).
- Account and company data — Removable via an account deletion request (/account-deletion). Exports are available under Data governance.
Data residency
A region counts as verified only while the operator's attestation matches the fingerprint of the live deployment configuration. If it stops matching or expires, we fall back to "unverified" — we never state a region by assumption.
This is an operator attestation, not an independent audit certification.
Data processing agreement (DPA)
We will send you one on request. Choose "Privacy" in the contact form's category.
PaddlePayments and billing as Merchant of Record · Billing details and subscription status
AnthropicAI generation and analysis · Documents and text included in the request
OpenAIAI generation and analysis · Documents and text included in the request
Google (Gemini)AI generation and analysis · Documents and text included in the request
Google (로그인·Play 결제)Social sign-in, Android in-app purchases · Email address and purchase receipts
AppleSocial sign-in, iOS in-app purchases · Email address (or private relay) and purchase receipts
FirebaseMobile app configuration · Device identifiers
메일 발송 공급자(SMTP)Sending invitations, notifications, and contact emails · Recipient email addresses and message bodies
S3 호환 오브젝트 스토리지Storage of uploaded files · Uploaded documents and images
Google Analytics 4 · Tag ManagerPublic-site usage analytics (consent-based) · Usage events, where consent was given