Privacy Statement

When your organization administrator creates your account, we collect:

• Identity data: First name, last name, email address
• Contact data: Phone number, phone country code (optional)
• Profile data: Avatar image (optional), timezone, currency, country, and date format preferences
• Credentials: Password (hashed and managed by our authentication provider — we never store plaintext passwords)

Organization administrators provide:

• Organization profile: Legal name, address, postal code, state/province, country
• Billing contact: Billing name, billing address, billing email, contact person details, purchase order number
• Subscription details: Selected plan, user/client limits, feature entitlements

We do not collect or store credit card numbers, bank account details, or payment card data. Payment processing is handled externally.

Users create and manage business data within the platform:

• Client records: Client name, client code, industry classification, country, address, contact information
• Fiscal year data: Year, date ranges, status
• Transfer pricing projects: Project names, document templates, generated documents, variable values used in document generation
• Files: Uploaded document templates (Word, Excel, PDF) and generated output documents, stored in cloud storage with version history

This is your organization's business data. We process it solely to provide the service — we do not use it for any other purpose.

To protect your account and detect unauthorized access, we collect:

• Login events: Timestamp, authentication method (password, OTP, magic link, 2FA), success/failure status
• IP addresses: Captured during login, OTP requests, magic link requests, and security-relevant actions
• User agent strings: Browser and device information captured during authentication and audited actions
• Two-factor authentication: Whether 2FA is enabled on your account (TOTP secrets are managed by our authentication provider)
• Failed login tracking: Number of failed attempts (used to trigger temporary account lockouts for your protection)
• OTP codes: One-time passwords generated for login verification (automatically expire after 10 minutes)
• Magic link tokens: Stored as cryptographic hashes (not plaintext), with expiration timestamps

All significant actions on the platform are logged for security and compliance:

• What is logged: The action performed, which record was affected, who performed it, when it happened, from which IP address, and with which browser/device
• Change tracking: For updates, we store the before and after values of changed fields
• Automatic redaction: Sensitive values (passwords, tokens, API keys, secrets) are automatically replaced with [REDACTED] before being stored

We use a minimal set of cookies — all essential for the platform to function:

We do not use advertising cookies, marketing trackers, or social media cookies.

We use Vercel Analytics and Vercel Web Vitals to understand platform performance (page load times, error rates). This data is aggregated and not linked to individual user accounts.

• Encryption in transit: All connections use HTTPS/TLS. HTTP Strict Transport Security (HSTS) is enforced.
• Encryption at rest: Database encryption provided by Supabase. Sensitive fields redacted in audit logs.
• Authentication security: Passwords hashed (bcrypt). Magic link tokens stored as SHA-256 hashes. OTP codes expire after 10 minutes.
• Account protection: Automatic account lockout after repeated failed login attempts. Optional two-factor authentication (TOTP). Organization-level MFA enforcement.
• Access control: Row Level Security (RLS) on all database tables ensures strict organization-based data isolation. Role-based access control (RBAC) with granular permissions.
• Input validation: All user input validated with schemas at API boundaries.
• Rate limiting: Redis-backed rate limiting on all endpoints to prevent abuse.
• CSRF protection: Double-submit cookie pattern with constant-time comparison.

We enforce the following HTTP security headers on all responses:

• Strict-Transport-Security (HSTS with preload)
• X-Frame-Options: DENY (prevents clickjacking)
• X-Content-Type-Options: nosniff
• Content-Security-Policy (restricts script sources, prevents injection)
• Permissions-Policy (disables camera, microphone, geolocation)
• Referrer-Policy: origin-when-cross-origin

• Multi-tenant architecture with strict organization-level data isolation
• Comprehensive audit logging of all data access and modifications
• Automatic redaction of sensitive data in logs
• Principle of least privilege in role-based access