Data handling: region, encryption, retention

Data handling: region, encryption, retention

LandedFees stores customer data in the European Union, in the eu-central-1 region (Frankfurt), on Supabase-hosted Postgres. Data at rest is AES-256 encrypted; data in transit is TLS 1.2 or higher. Uploaded invoices, entries, and calculations are stored in the same regional bucket as the application database.

The trust page is the always-current summary. What follows is enough context to answer common data-handling questions.

Where the data lives

Primary database: Supabase Postgres, eu-central-1. Object storage (uploaded 7501s, SADs, and other entry PDFs): Supabase Storage, same region. Nothing about the standard subscription moves data outside the EU.

Enterprise customers with a specific residency requirement can request a US-region mirror or a fully hosted deployment. Contact sales via /pricing.

Encryption

At rest: AES-256 on database volumes and on object storage. Integration secrets (SFTP passwords, private keys, webhook signing secrets) are encrypted a second time at the application layer using the shared secret in lib/integrations/crypto.ts, so a database-level compromise does not leak plaintext credentials.

In transit: TLS 1.2 minimum on every public surface. HSTS is set on the marketing origin and on the app origin.

Retention

Free tier: calculations retained for 90 days from last view. Audit findings retained for the life of the account (up to Free's cap on total audits).

Paid tiers: all data retained for the life of the subscription, plus 30 days after cancellation for reactivation.

Deletion requests processed through /dashboard/account trigger the durable per-processor GDPR erasure jobs (LFQG-110). See export or delete your data for the mechanics.

Sub-processors

The list is on the /trust page and enumerated in sub-processor list.

Frequently asked questions

Can I get a US-region deployment

Enterprise customers can. Contact sales. Pro through Business are EU-only.

Do you comply with GDPR

Yes. Data subject rights (access, deletion, portability) are handled through the account settings page. Durable per-processor erasure jobs (LFQG-110) ensure erasure propagates to every sub-processor.

What about SOC 2 or ISO 27001

Not yet certified. Our security posture is documented on /trust. Certification is an active roadmap item; expected timeline is subject to funding milestones.

Where can I get a signed DPA

Business tier and Enterprise. Request from sales; the DPA is available before signature.