How we look after your clients’ documents
Bank statements, invoices and receipts are some of the most sensitive papers a business has. This page sets out, in plain terms, where they are kept, who can open them and how long we keep them.
In short
Stored in the UK
Accounts, documents and results are kept in UK data centres, in London.
Every document has its own key
Each document and each result is encrypted separately, before it is stored.
Two-step sign-in for everyone
A password or a Google or Microsoft sign-in, then a code from an authenticator app. No exceptions.
Support sees only what you share
Our team can open a document only while you have shared it on an open support ticket.
Not kept longer than needed
Deleted on the schedule in our privacy policy, and you can delete any document yourself at any time.
No card numbers
Payments are handled by our payment provider. We never receive or store full card numbers.
In detail
- Where your data is
- Your account, your documents, the data read from them and your signed documents are stored in UK data centres, in London. To read a document, its pages are processed by our AI service providers in the European Union, under contract and only to provide the service to you. Storage, the database and the key vault accept connections only from Caelum’s own services, on their own private network.
- Encryption
- Every document and every result is encrypted with its own random 256-bit key (AES-256-GCM) before it is stored, so a storage credential or a copy of a backup is not a way to read them. Those keys are locked by a master key held in a key vault; our application asks the vault to unlock a key and never holds the master key itself. A document copied to another place will not open. Everything between you and Caelum travels over encrypted connections.
- Signing in
- Every account uses two-step sign-in: a password, or a Google or Microsoft sign-in, and then a code from an authenticator app. Nothing counts as a sign-in until the second step. Passwords, recovery codes and remembered devices are stored only in a form that cannot be turned back into the original. Five wrong codes or ten wrong passwords lock that step for 15 minutes. A device can be remembered for 30 days, and you can see and remove remembered devices yourself.
- Your team and the API
- Each teammate signs in as themselves, with their own second step, so nobody shares a login. Only the account’s administrator can make or revoke an API key, and only after confirming with a fresh code; we email them each time. The key is shown once: we keep only a fingerprint of it and its last four characters, so a copy of our database does not give anyone your key.
- Who at Caelum can see your documents
- Our support team can open a document only when you have shared it on a support ticket, and only while that ticket is open. When they look, it is recorded on the ticket for you to see. Documents shared on a ticket are deleted 30 days after the ticket is last closed.
- How long we keep it
- Documents and the data read from them are kept for a year while you have a plan or have bought credits, for 90 days once a subscription ends, and for 30 days on a free trial. We email you before anything is deleted, so you can download what you need, and you can delete any document yourself at any time. Signed documents and their audit trails are kept for six years after signing, as a record for everyone who signed. Database backups are kept for seven days. The full schedule is in our privacy policy.
- Password-protected PDFs
- Bank e-statements often come locked. In the dashboard a locked PDF is unlocked in your own browser before it is uploaded, so the password never reaches us. Through the API, the password is used once to unlock the file and is never stored or logged.
- Payments
- Card payments are handled by our payment provider. We never receive or store full card numbers.
- Your rights and your data
- You can download your data or close your account yourself, in the dashboard under Account & security, then Your data. Mindrops UK Ltd is the data controller under UK GDPR. See the privacy policy and Delete your account.
- Telling us about a concern
- If you think you have found a security problem, or suspect someone has reached your data, email security@caelum.ai straight away. Security questions from your firm are welcome at the same address.
Questions
Anything else? Get in touch.
Where is our data stored?
Accounts, documents, the data read from them and signed documents are stored in UK data centres, in London. To read a document, its pages are processed by our AI service providers in the European Union, under contract and only to provide the service to you.
Is every document encrypted?
Yes. Each document and each result is encrypted with its own 256-bit key (AES-256-GCM) before it is stored. Those keys are themselves locked by a master key held in a key vault, which our application never holds. Everything travels over encrypted connections.
Can your staff see our documents?
Only documents you share on a support ticket, and only while that ticket is open. You can see when support looked at them. There is no override for our own team.
Is two-step sign-in optional?
No. Every account needs a code from an authenticator app as well as a password or a Google or Microsoft sign-in. A device can be remembered for 30 days, and you can see and remove remembered devices at any time.
How long do you keep documents?
A year while you have a plan or have bought credits, 90 days once a subscription ends, and 30 days on a free trial. We email you before anything is deleted. Signed documents and their audit trails are kept for six years. You can delete any document yourself sooner.
What happens to the password of a protected PDF?
In the dashboard the PDF is unlocked in your own browser, so the password never reaches us. Through the API it is used once to unlock the file and is never stored or logged.
Can we close our account and take our data?
Yes. In the dashboard, go to Account & security, then Your data, to download your data or close your account.
Try it on your own statements
Free credits when you sign up, no card needed if you sign up with a business email. Upload a statement and see the rows, and the check, in under a minute.