Security summary
How TechniFile handles your documents, in short. It is drawn from the TechniFile trust pack, which names every subprocessor and what we cannot claim yet; your QA or IT reviewer can have it in full.
Where your documents are
- The engine and its working store run in Frankfurt, Germany.
- Every document is mirrored, before TechniFile acknowledges it, to object storage created under EU jurisdiction: stored and processed in the EU, with no replication to North America.
- Encrypted in transit everywhere, and at rest on disk and in the mirror.
- The portal and this website hold no client data and no secrets.
What the model sees
- A step that needs judgment sends the documents it reads, with its prompt, to the model provider named in the trust pack. No engine code is sent.
- No analytics service receives document content, nothing is shared between clients, and your documents never become training data, ours or anyone's.
- If you want model calls under your own agreement, bring your own endpoint and key.
One workspace per client
- Storage, retrieval, prompts and queues are scoped to the client behind every request, and no query spans clients.
- The isolation is tested adversarially: each test client's documents name the other's, and every role tries every action it must not take.
Access
- Each person signs in with their own access key, issued by your administrator, shown once and stored only as a hash.
- A session expires after twelve hours and ends after forty-five idle minutes; repeated failed sign-ins from one address are refused for a minute.
- Every member works on documents; an administrator also manages people, keys, configuration, export and deletion.
- Single sign-on and MFA are not built yet; they come with the first client whose policy requires them.
Retention, export and deletion
- Documents, runs and decisions are kept while you are a client. Nothing is deleted on a timer.
- A deletion (one run, one document or everything) is completed within 30 days, from every copy, and leaves a record of what was removed and when.
- Your export bundle (your documents, your inputs and your decision register) is yours to download at any time, up to the moment of deletion.
What we do not claim
- We hold no SOC 2 or ISO 27001 attestation of our own. Our hosting providers do, and their reports are available to us under NDA.
- TechniFile is not a QMS and not a system of record.
- No AI tool is regulator-approved. We never claim approval, acceptance or a pass rate; your qualified people approve every output.