Learn how Finflo protects your documents and extracted data with enterprise-grade security practices, Australian data residency, and transparent data handling.
Last updated: February 2026
Data encrypted at rest and TLS 1.2/1.3 in transit
All infrastructure hosted in Australia for data sovereignty compliance
Automated SAST, DAST, SCA, and cloud infrastructure checks
Your documents are never used to train AI models
Finflo is a document processing platform that uses AI to extract structured data from PDF documents. We understand that the documents you upload may contain sensitive financial or business information, and we've built our security practices around protecting that data.
This page provides a transparent overview of how we secure your data, what technologies we use, and what commitments we make regarding your information.
Our security strategy is built on five pillars: Australian data residency for sovereignty compliance, defence-in-depth network protection, automated PII data lifecycle management, continuous security testing across the full stack, and transparent data handling practices.
Finflo's core infrastructure — including the application backend, background task workers, PostgreSQL database, and Redis cache — is hosted on Northflank in the Australian region, ensuring all application data remains within Australian borders for data residency compliance.
Northflank provides enterprise-grade infrastructure security including:
View Northflank's Security page
All uploaded documents are stored in Google Cloud Storage with servers located in Australia, which provides:
View Google Cloud Security overview
Application data is stored in a managed PostgreSQL database hosted in Australia with:
All core infrastructure components — application servers, databases, caches, background workers, and file storage — are hosted in Australian data centres. This ensures your document data and extracted information remain within Australian jurisdiction, supporting compliance with the Australian Privacy Act and data sovereignty requirements.
File storage benefits from Google Cloud's built-in redundancy and durability guarantees (99.99% annual durability).
All traffic to Finflo is routed through Cloudflare, providing multiple layers of network-level protection before requests reach our application servers.
View Cloudflare's Trust & Compliance resources
| Data State | Encryption |
|---|---|
| Data in Transit | TLS 1.2/1.3 |
| Files at Rest | AES-256 |
| Database at Rest | AES-256 |
| Passwords | Industry-standard hashing (Argon2) |
Each user's data is logically isolated at the application level. All database queries are filtered by user identity, ensuring you can only access your own templates, documents, and extraction results.
Database backups are performed daily and retained for 7 days. File storage benefits from Google Cloud's built-in redundancy and durability guarantees (99.99% annual durability).
Finflo implements automated data lifecycle management to minimise the retention of personally identifiable information (PII) and sensitive document data.
A scheduled background process runs every 7 days to automatically clean up document data that is no longer needed for active use. This process:
| Data Type | Retention |
|---|---|
| Uploaded PDF documents | Automatically deleted every 7 days |
| Extraction output files | Automatically deleted every 7 days |
| Extraction JSON data | Automatically deleted every 7 days |
| Templates | Retained until you delete them or your account |
| Account data | Retained for the lifetime of your account |
| Deletion audit logs | Retained for compliance purposes |
| Server logs | 30 days |
By automatically deleting document files and extraction data on a 7-day cycle, we significantly reduce the window of exposure for sensitive information. This approach follows the data minimisation principle recommended by the Australian Privacy Act and GDPR.
Finflo employs a multi-layered security testing strategy that combines static analysis, dynamic testing, and continuous monitoring to identify and remediate vulnerabilities across the full application stack.
We use Aikido Security for continuous static analysis of our codebase, covering:
We use OWASP ZAP (Zed Attack Proxy) for dynamic security testing against our running application, including:
| Layer | Tool | Coverage |
|---|---|---|
| Source Code | Aikido Security | SAST, SCA, Secrets, IaC |
| Running Application | OWASP ZAP | DAST, OWASP Top 10 |
| Network Edge | Cloudflare WAF | WAF rules, DDoS, bot management |
| Runtime Monitoring | Sentry | Error tracking, performance monitoring |
Finflo uses industry-standard authentication practices to protect your account and ensure only you can access your data.
We enforce strong password policies to protect your account:
We're actively working on additional security features including two-factor authentication (2FA) and social login options to give you more control over your account security.
Finflo uses Google Cloud AI services to extract structured data from your documents. Here's how your data is handled during AI processing:
Your documents are not used to train AI models. We use Google Cloud's enterprise AI services which have explicit data usage policies prohibiting training on customer data.
Document content is only sent to AI services during active extraction. It is not persisted by the AI provider beyond the processing request.
All communication with AI services occurs over encrypted TLS connections.
Uploaded documents and extraction data are automatically deleted on a 7-day cycle, with audit logs maintained for compliance.
Our infrastructure providers maintain their own compliance certifications:
We employ comprehensive monitoring and logging across our infrastructure to detect and respond to potential security issues. Our systems include real-time error tracking via Sentry, structured audit logging for security-relevant events, Cloudflare WAF analytics for threat detection, and automated alerting for anomalous activity.
In the event of a security incident, we commit to:
If you discover a security vulnerability in Finflo, please report it to us immediately at security@finflo.au. We ask that you:
We believe you should have control over your data. Here are your rights and how to exercise them:
You can export your extraction results to Excel format directly from the application. For a complete export of all your data, contact us at finflo-support@finflo.au.
Document files and extraction data are automatically deleted every 7 days. You can also manually delete individual templates, documents, and extractions at any time. To delete your entire account and all associated data, contact us at finflo-support@finflo.au.
You can view all your stored templates and extraction history within the application. For questions about what data we hold, contact us.
We aim to respond to data requests within 30 days, in compliance with GDPR and Australian Privacy Act requirements.
For security-related inquiries, vulnerability reports, or questions about our security practices:
Security is an ongoing commitment, not a one-time milestone. We continuously strengthen our security practices and will keep this page up to date as we introduce new safeguards to protect you and your data. Thank you for trusting Finflo with your document processing needs.