How Fidify protects client data

Documents are encrypted on your device before they reach our servers. Your keys are unlocked only by your personal passcode or biometric. A service provider can read a document only when you actively share it with them. Never by default, and never by us.

Your data lives in the jurisdiction your regulator requires. EU customers are hosted in the EU today. Customers in the Middle East, Africa, or other regions can be hosted in a matching region on request. Data never leaves the agreed jurisdiction.

Your organisation runs in its own environment with its own database. Your client records are not rows in a table you share with another customer. A small number of platform services are common to all deployments and keep each customer data separated; we will take your reviewers through exactly which is which.

Published DPA. Named Data Protection Officer reachable at dpo@fidify.se. Sub-processor list available and kept current.

Industry-standard encryption at rest and in transit, plus client-side encryption for sensitive uploads.

Least-privilege access with named, MFA-protected personal accounts. No shared credentials. Production access is audited.

Automated dependency and code scanning on every build. Regular third-party penetration testing. Defined patching cadence by severity.

Documented incident management procedure with centralised logging held within your jurisdiction and a defined breach-notification process aligned to GDPR Article 33.

Regular automated backups held in a second region, with a documented recovery procedure. Environments can be rebuilt in a new region if needed.

Mandatory automated and manual testing before release. Separated development, test, and production environments.

Bring your own LLM provider (OpenAI, Anthropic, Mistral, or your own enterprise contract), or use Fidify's default. Lets your AI governance committee keep its existing posture, and lets you align with EU AI Act and DORA model-risk requirements.