Security
Your clients' paperwork is the most sensitive thing they own.
So this page states what is true before it states anything persuasive, and every line can be checked against the contract or the controls below.
- Your documents
- Not used for trainingPages are read in the EU, and we do not use your documents to train models.
- Processed in
- The EURead, reconciled and written to a workbook on our EU infrastructure. Storage carries an EU placement, which we describe exactly in chapter II.
- The contract
- Published in fullThe Data Processing Agreement, with sub-processors described by role, and the named list on request. No form, no sales call.
- Breach notice
- Within 72 hoursAnd what that message will contain is written down here, before there is anything to tell.
- Delete everything
- On request, after the retention periodAsk us to close the account and we delete your data once the retention period has passed. Any single file can go earlier.
I
It answers the question you actually came with.
“If I upload my clients’ invoices, does that end up training somebody’s AI?”
No. We do not use your documents to train models.
Your documents are encrypted and private to your account. Document pages are read in the EU. We do not use your documents to train models.
II
Our back-end servers are in Germany. Client documents are processed and stored in the EU once they arrive; uploads cross a global edge network first.
- Read and reconciled in the EUThe pipeline that opens your documents, works out the VAT and writes the workbook runs on our EU infrastructure. The provider that reads the text is in the EU too.
- Stored in the EUStored documents sit in an EU-jurisdiction object store: they stay inside the EU, though not pinned to one country.
- Never sent out for anything elseNo client document goes outside that path. Not for support, not for analytics, not for training.
Billing details, once billing is live, reach a payment processor, sign-in details reach our sign-in provider, and an address reaches the email service; none of them ever receives a client document.
Where a claim rests on a provider's published statement rather than our own systems, we say so.
III
What leaves, and what it carries.
Not a promise that nothing leaves. A list of what does, who receives it, and what they may do with it.
Inside Pileform
Your clients’ documentsEncrypted at rest. Scoped to your account. Deleted files go to a bin, where you can restore them for seven days; after that they are removed, unless a job is still processing them or they are on hold.
Never crosses the line
Crosses the line
Document reading and categorisationReceives: the document you uploadedRead in the EU
PaymentsOnce billing is live, receives: your billing name, address and card detailsNever a client document
Transactional emailReceives: a recipient address and a linkNever a document, never its contents
Sign-inReceives: your name and email address, your password at sign-in, and the network address and browser of each sign-inNever a document
IV
The controls, in full.
Nothing here is a summary of something longer. This is the whole list.
Encryption
- In transit
- TLS on every connection over the internet.
- At rest
- Stored files are encrypted at rest by our storage provider, as it publishes for every object.
Authentication
- Passwords
- Passwords: at least 12 characters, checked against known breached passwords. We never store your password.
- Sessions
- Session cookies are HTTP-only, Secure and SameSite=Lax, encrypted and tamper-proof, and last at most eight hours. There is no permanent “remember me”.
- Sign-in
- Sign-in attempts are rate limited per network address and per account.
- Your email address must be verified before you can sign in.
- OAuth
- You can also sign in with an existing work or personal account.
Isolation
- Every row
- Every record carries the account that owns it.
- Every query
- Every query is scoped to your account, and automated tests check that one account cannot read another's files.
- Every object
- Stored under a per-account prefix, as
org/{account-id}/file/{file-id}. - Every request
- A download link is issued only after the file is checked against your session, and it expires in ten minutes.
Network
- Edge
- A global edge network sits in front of all production traffic.
- Volume
- An anycast network absorbs volumetric attacks before they reach the origin.
- Origin
- Our back-end server reaches the document engine over a private network, and the job-completion endpoint accepts only an authenticated internal call.
- DNS
- DNSSEC enabled.
Logging
- Audit log
- Account and job changes go into an append-only audit log with the time and the person who acted.
- Errors
- Server errors are logged on our own servers.
Retention
- Default
- At least six years, the Cyprus minimum. Nothing is deleted automatically unless automatic deletion is turned on at your request.
- Automatic deletion
- Then records past the retention period (six years by default, up to 100, or kept forever) move to a recycle bin after a preview and 30 days' email notice.
- Early deletion
- Any single file can be deleted earlier.
- Leaving
- Download your stored documents as a ZIP archive at any time. For a full copy of your account data, email us.
V
What you can do, and what to ask us
Rotate your passwordReset your password at any time from the sign-in page.
Revoke a sessionSee your signed-in sessions and sign any of them out from Settings.
Close your accountAsk us to close the account and we delete what we hold once the retention period has passed. Any single file can be deleted earlier.
Download your documentsDownload your stored documents as a ZIP archive at any time. For a full copy of your account data, email us.
VI
If we get it wrong.
We will tell you within 72 hours of detecting or being notified of a breach affecting your data, as Article 33 requires. Here is what that message will contain, written down now, while there is nothing to tell.
- What happened, and the root cause as far as we know it.
- What data was affected. The specific scope, not a vague generality.
- What we have already done to contain and fix it.
- What you should do now, concretely, including whether to tell your client.
We report to the Cyprus Data Protection Commissioner where required, and publish a post-mortem where the breach is material.
VII
How to check any of this.
Read the contractThe Data Processing Agreement is published in full, with each sub-processor described by role; the named list is available on request. No form, no sales call.Data Processing Agreement Privacy policy
Found something wrong?Good-faith security research does not result in legal action from us. Do not access another account’s data, and give us reasonable time to fix it before disclosing. We respond within two business days.security@pileform.com
Sub-processor changesActive customers are notified 30 days before any change takes effect, as Article 28 requires. Nothing is added quietly.
CertificationsGDPR: our back-end servers are in the EU (Germany) and client documents are processed and stored in the EU once they reach those servers (uploads pass through a global edge network on the way), under our Data Processing Agreement, published in full, in line with GDPR. SOC 2 Type II and ISO 27001: both are under way. Neither certificate has been issued yet, and the marks above say so rather than implying otherwise.
Start with one period.
One company’s documents, exactly as they arrived. An account comes with 30 non-expiring signup pages, no card required.
Create free account