Privacy & security
EaaS data handling - 7-day expiring PDF download links, data minimization, regional data residency, and SOC 2 Type II and GDPR compliance.
Chargeflow is designed to handle sensitive dispute data responsibly. This page describes the data handling practices that apply specifically to Evidence-as-a-Service.
Short-lived download links
Evidence PDF download URLs expire 7 days after they are issued. If you need to retrieve the PDF after the link has expired, call the evidence API to request a fresh download URL.
Info
Store the evidence.id (not the file_url) as your persistent reference to a generated evidence package. The id is permanent; the file_url is temporary.
Data minimization
You control what dispute data you send to the Generate Evidence API. The AI agent selects only the most impactful details to include in the evidence package; you do not need to curate the payload manually.
Only data relevant to the specific dispute needs to be shared. Do not include unrelated merchant or customer data in the request body.
Regional data residency
Chargeflow supports regional storage options to meet data residency requirements. If your platform operates in a region with specific data localization requirements, contact your account manager to discuss available storage region configurations.
Compliance certifications
Chargeflow is SOC 2 Type II audited and GDPR-compliant. Certifications, reports, encryption standards, and data-handling policies live in Security & compliance and the Trust Center.
Webhook notifications
You are notified via webhook when PDFs are ready for download (evidence.ready) or when generation fails (evidence.error). This means your integration never needs to poll for status; Chargeflow pushes updates as soon as they are available.
See Webhook Events for payload details and how to verify webhook signatures.