Filvacy protects your data at every level: encryption in transit, at rest, and a dedicated encryption key per client file. When a file is deleted, the data becomes permanently and irreversibly inaccessible.
Encryption
Your data is encrypted in transit and at rest. Each client file has its own encryption key — complete isolation between your clients. Filvacy contractually commits to accessing data solely for the purpose of providing the service.
Encryption
AES-256-GCM
Data and files at rest
Transit
TLS 1.3
All communications
Isolation
Key per file
One file = one dedicated key
Deletion
Permanent
Immediately inaccessible
Compliance
Compliant with the General Data Protection Regulation (EU 2016/679).
Compliant with the Act respecting the protection of personal information in the private sector (Law 25).
Information security management — certification in progress.
Your data stays in your jurisdiction — by design, not as an option.
No inter-region transfers by default.
Security
Data Protection
In accordance with GDPR, Law 25 and PIPEDA, you have the following rights as a Filvacy user.
Access
Obtain a copy of all your personal data processed by Filvacy.
Rectification
Correct any inaccurate information about you.
Erasure
Request deletion of your account and all your data.
Portability
Export your data in a standard format from your dashboard.
Restriction
Restrict the processing of your data in certain circumstances.
Objection
Object to certain processing based on legitimate interest.
Transparency
Filvacy uses carefully selected subprocessors, all compliant with GDPR requirements.
| Provider | Role | Certifications |
|---|---|---|
| Supabase | Database & storage | SOC 2 Type II, ISO 27001 |
| DigitalOcean | Hosting | SOC 2 Type II, ISO 27001 |
| Stripe | Payments | PCI DSS Level 1, SOC 1 & 2 Type II |
| Resend | Transactional emails | SOC 2 Type II, RGPD conforme |
| Sentry | Error monitoring | SOC 2 Type II, ISO 27001 |
This list is kept up to date. For any questions about our subprocessors, use our contact form.
Documentation
Report a vulnerability:
Report via the form →We are committed to responding to any responsible disclosure within 5 business days.
Our commitments