# Privacy & security (https://docs.chargeflow.io/docs/platforms/eaas/compliance)



Chargeflow is designed to handle sensitive dispute data responsibly. This page describes the data handling practices that apply specifically to Evidence-as-a-Service.

## Short-lived download links [#short-lived-download-links]

Evidence PDF download URLs expire **7 days** after they are issued. If you need to retrieve the PDF after the link has expired, call the evidence API to request a fresh download URL.

<Callout title="Info">
  Store the `evidence.id` (not the `file_url`) as your persistent reference to a generated evidence
  package. The `id` is permanent; the `file_url` is temporary.
</Callout>

## Data minimization [#data-minimization]

You control what dispute data you send to the Generate Evidence API. The AI agent selects only the most impactful details to include in the evidence package; you do not need to curate the payload manually.

Only data relevant to the specific dispute needs to be shared. Do not include unrelated merchant or customer data in the request body.

## Regional data residency [#regional-data-residency]

Chargeflow supports regional storage options to meet data residency requirements. If your platform operates in a region with specific data localization requirements, contact your account manager to discuss available storage region configurations.

## Compliance certifications [#compliance-certifications]

Chargeflow is SOC 2 Type II audited and GDPR-compliant. Certifications, reports, encryption
standards, and data-handling policies live in
[Security & compliance](https://docs.chargeflow.io/docs/reference/security) and the
[Trust Center](https://trust.chargeflow.io/).

## Webhook notifications [#webhook-notifications]

You are notified via webhook when PDFs are ready for download (`evidence.ready`) or when generation fails (`evidence.error`). This means your integration never needs to poll for status; Chargeflow pushes updates as soon as they are available.

See [Webhook Events](../webhook-events) for payload details and how to verify webhook signatures.

## Next steps [#next-steps]

<Cards>
  <Card title="Generate and regenerate evidence" href="./generate-and-regenerate">
    Kick off evidence generation.
  </Card>

  <Card title="evidence.ready" href="../webhook-events#evidence-ready">
    Download the PDF when it is ready.
  </Card>

  <Card title="How it works" href="./how-it-works">
    The end-to-end EaaS flow.
  </Card>

  <Card title="What is EaaS?" href="./introduction">
    The EaaS overview.
  </Card>
</Cards>