Security & Compliance

The plain-language version

Your data stays in the EU. Databases, file storage, queues, and logs run in Stockholm (eu-north-1). Nothing is replicated outside the EU.
You can leave completely. One request erases your account across every system we run, and we record which system confirmed deletion, when.
We watch who reads your reports. Every report view and download is logged. Enterprise customers can request the access trail.
The AI never sees more than it needs. Image classification reads your photos; report narration reads your inputs and the computed numbers. Neither can touch your account or payment data.
Payments never touch our servers. Card details go directly to Stripe.

Encryption in transit	TLS 1.2+ on every connection, service-to-service included
Encryption at rest	AES-256, cloud KMS-managed keys
Region pinning	Postgres, Redis, object storage, auth, logging: all pinned to EU (Stockholm)
Database privilege separation	Three Postgres roles enforced with GRANT/REVOKE: the valuation engine cannot read user or billing tables; the scraper can only write comparables. A bug in either cannot leak account data.
Process isolation	The scraping worker runs in its own container with its own resource limits, so a scraping spike cannot starve the API or the valuation engine.
Right to erasure	Scheduled job cascades deletion across Postgres, Redis, S3, and backups; each erasure request records systems_cleared per system.
Secrets	Cloud secrets manager. Never in committed files.
Audit logging	Sensitive account actions in audit_log; report access in report_access_log.