Trust Center

Freya processes sensitive tax data. That imposes three duties: confidentiality (encryption + access control), integrity (audit log + immutable trails), and availability (backups + monitoring). What follows is the current state — not plans.

Sensitive fields are encrypted before being written to the DB, using a key stored in Vercel env (not in code):

• Algorithm: AES-256-GCM (12-byte IV, 16-byte authentication tag) — source: src/lib/crypto.ts.
• Encrypted: client NIPs, REGONs, bank accounts, PESEL, ZUS p12 certificates, KSeF tokens, e-Bramka auth data.
• Key rotation supported: primary ENCRYPTION_KEY + fallback keys for backward compatibility without downtime.
• TLS 1.2+ for all connections (HSTS, secure cookies, SameSite=Lax).

Every data mutation is written to a dedicated table at the Postgres trigger level, which forbids UPDATE/DELETE:

• We capture: action, entity, before/after JSON, IP, user agent, request ID, timestamp.
• The append_only_audit_logs trigger in the schema guarantees that entries cannot be changed or deleted through normal DB access.
• The log is append-only and retained indefinitely — a permanent evidentiary record of operations (including the account deletion itself). Basis: legitimate interest — accountability and security (art. 6(1)(f) GDPR); after account anonymization the entries contain no identifying data.

Sessions are managed by Clerk (EU-deployed auth provider):

• 2FA supported (TOTP, SMS, WebAuthn) — every user enables it in the Clerk profile.
• Short-TTL JWT (60 seconds) + automatic session token rotation.
• Admin/bookkeeper console requires a separate sudo-mode + RBAC permissions (laws.read/review/publish etc.).

All infrastructure is in Frankfurt:

• Vercel — region fra1 (Frankfurt) for serverless functions and edge.
• Neon (Postgres) — region eu-central-1 (Frankfurt).
• The AI chat (Anthropic) is the only sub-processor that may process a request outside the EU. Data is transmitted only when the user actively writes in chat, and is covered by SCC 2021/914. Details — Privacy §6.

We mitigate data loss on two layers:

• Neon PITR (Point-In-Time Recovery) — we can roll the DB back to any moment within the last 7 days.
• Daily snapshot — encrypted backups for 30 days.
• User data export is available from Settings → Export — you can take everything as JSON anytime.

One user = one logical tenant zone. Every DB query is filtered by userId at the Prisma layer:

• Cross-tenant reads are impossible — enforced in code (Postgres RLS will be enabled if needed).
• Admin roles use a separate getCurrentAdmin() getter with logging on every access to another user's data.

On a confirmed breach: 72 hours to notify UODO (GDPR art. 33) + individual notifications to affected users (art. 34).

Suspected incident → email shaposhnik.mcd@gmail.com with the tag «Security incident». We review within 24 hours.

Honest list of what we do NOT have today — so as not to mislead:

• SOC 2 / ISO 27001 certifications — not justified for our size; we'll obtain them when we move to enterprise.
• Penetration test — scheduled for 4Q 2026. Current scans — daily SAST via GitHub CodeQL + npm audit.

Last updated · 28 May 2026