Security and your data

The file travels encrypted over HTTPS (TLS). The web app is served over HTTPS and our API, at api.finiaerp.com, uses a Let's Encrypt certificate.

On the server, the file is written to a temporary folder and sent to our statement-reading service over an internal network on the same server. When processing ends, whether it succeeds or fails, we delete that temporary file. We do not keep the original file.

One caveat: if the server restarts right while your file is being processed, that temporary copy may remain on the server's disk. Today there is no automatic cleanup of those leftovers.

From the file we keep what is needed to reconcile:

• The transactions read from it: date, description, amount, reference and the original row exactly as it came in the file.
• The file details: name, detected columns and processing status.
• The reconciliations you create.

Everything is stored in a PostgreSQL database, on a Hetzner server in Germany, until you delete it. There is no automatic expiry.

We make a daily backup on the same server and each backup is kept for 14 days. So something you delete may remain in a backup for up to 14 days before it is fully gone.

You, with your account.

FinIA Conciliación team members with an administrator role can access account data to provide support and operate the service. The admin panel records an audit entry every time an administrator opens a user's profile.

We do not sell your data or share it with advertisers.

When something fails, we send the technical error to Sentry, our monitoring service, without personal data: we strip authorization headers, cookies, email addresses and file contents.

The list of providers that process data on our behalf, with their purpose and region, is on the subprocessors page.

In the app, go to Files. There you can delete one file or all of your files.

Deleting a file also deletes its imported transactions and the reconciliations that use it. Before deleting, we tell you what will be lost and ask you to confirm.

Deletion in the database is immediate. Deleted data can only remain in backups, for up to 14 days, as explained above.

Colombia's Law 1581 of 2012 gives you the right to:

• Know, update and correct your data.
• Request proof of the authorization you gave us.
• Be informed about how we use your data.
• Revoke the authorization or ask us to delete your data, when there is no legal or contractual duty to keep it.
• File complaints with the Superintendency of Industry and Commerce (SIC), after going through the process with us.
• Access your data free of charge.

To exercise them, write to contacto@finiaerp.com from your account's email address.

We answer queries within up to 10 business days and claims within up to 15 business days (Law 1581 of 2012, articles 14 and 15).

When you arrive on the site, we store in your browser (in its local storage, not in a cookie) where you came from: the link's utm_* parameters, the ref code if present, the gclid or fbclid identifiers if present, the first page you landed on and the site that referred you, without its query parameters.

That data expires after 90 days, is not overwritten by later visits and is only sent to us if you create an account.

We do not use third-party cookies or advertising pixels.

If you find a vulnerability or something that worries you, write to contacto@finiaerp.com.