This policy describes how Summafolio stores and protects the statements and matter data you upload ("Customer Content"). It supplements our Privacy Policy and Terms of Service.
What we store
For each matter: uploaded statement files, the parsed ledger (accounts, transactions, categories, allocations, holdings and values), beneficiaries, reviewer notes, sign-off records, generated exports and an audit trail of changes.
Encryption
- At rest: each matter has its own randomly generated data key. Statement files, the ledger and the audit log are encrypted with it using Fernet (AES-128 in CBC mode with HMAC-SHA256 authentication). Data keys are themselves encrypted ("wrapped") by a master key that is stored separately from the data.
- In transit: connections to the Service use TLS.
- Tampering: encrypted files are authenticated; altered files fail to decrypt rather than returning wrong data.
Retention and deletion
- Matters are deleted automatically when the workspace's retention period expires (90 days after creation by default; firm administrators can choose 7 to 365 days). A scheduled job enforces it.
- You can delete a matter at any time. Deletion overwrites and removes the matter's wrapped data key before removing its files ("crypto-shredding").
- Exports are generated on request and not kept on our servers after they're delivered.
- Hosting-provider backups, if any, expire on the provider's schedule and contain only encrypted Customer Content.
Access
- Each firm workspace is isolated; users see only their own workspace's matters.
- Application sessions are signed and expire after 8 hours.
- Our personnel access Customer Content only at your request for support, to investigate abuse or a security incident, or when required by law.
Integrity
Every import, categorization, allocation override, note, sign-off and export is recorded in an append-only audit log. Each entry includes a SHA-256 hash of the previous entry, so any alteration breaks the chain. Sign-off records a hash of the accounting's contents and is revoked automatically if anything changes later.
AI and training
Built-in parsers read CSV, OFX/QFX and most text-based PDF statements without any third party. If we use an AI provider to read an unusual statement layout, it will be named in the Privacy Policy before it receives Customer Content, and bound by contract not to retain it or use it for training. We never use Customer Content to train models.
Minors
Matters involving minors are blocked by attestation, a per-beneficiary adult confirmation and an automated screen of matter details.
Incidents
If we become aware of unauthorized access to Customer Content, we will investigate, contain it, and notify affected customers and authorities as required by law. Report security issues to security@summafolio.com.