Security & compliance
How Chargeflow secures your data, our certifications (SOC 2 Type II, GDPR), data residency, subprocessors, AI governance, and where to request security documents.
Chargeflow follows enterprise-grade security and compliance practices for handling financial and customer data. This page summarizes our posture and links to the canonical source for every report and policy.
Trust Center
The Chargeflow Trust Center is the single source of truth for our certifications, security policies, and data-privacy documentation, including the SOC 2 Type II report, penetration test report, and DPA. Access to gated reports is granted on request.
Certifications & compliance
| Standard | Status |
|---|---|
| SOC 2 Type II | Certified - current attestation at the Trust Center |
| GDPR | Compliant |
| ISO 27001 / 27017 / 27018 | Planned - current status at the Trust Center |
| CCPA | Planned - current status at the Trust Center |
| PCI DSS | Not held (see below) |
On PCI DSS: Chargeflow does not store raw PAN (full card numbers) and does not operate as a cardholder-data environment, so a PCI attestation is generally not applicable. Chargeflow may ingest non-sensitive card-related dispute attributes exposed by your payment processor, such as BIN, last four, brand, expiration metadata, and AVS/CVV results, when needed to build evidence.
All certificates and reports are available at trust.chargeflow.io.
Data handling & privacy
- What we process: the customer, transaction, dispute, and enrichment data needed to automate dispute management (names, contact details, order and transaction metadata, reason codes and deadlines, evidence files, and related signals).
- What we do not store: raw PAN / full card numbers.
- Roles under GDPR: Chargeflow acts as a data processor on your behalf; you remain the data controller. Data-subject requests are handled per the Data Processing Agreement, and transfers out of the EEA are covered by Standard Contractual Clauses.
- Encryption: all data in transit is encrypted with TLS 1.2 or higher; all data at rest is encrypted with AES-256 or equivalent.
- Authentication: all user accounts require MFA. See Authentication for API key and HMAC options.
- Historical data: Chargeflow ingests roughly the past 24 months of chargeback data from connected processors.
Data Processing Agreements and the full privacy documentation are available at trust.chargeflow.io.
Hosting & availability
- Infrastructure: single-tenant on AWS, primary region
us-east-1. Specific regional data-residency requirements can be reviewed and supported on request. - Availability: contractual uptime SLAs are set per agreement; live availability is published at status.chargeflow.io.
- Disaster recovery: RPO of 6 hours, RTO of 24 hours. As a pure cloud platform, Chargeflow can redeploy to any available AWS region.
- Scalability: serverless architecture with no practical limit on accounts, processors, merchants, or dispute volume.
Live status is published at status.chargeflow.io.
AI governance & data use
- No training on your data: Chargeflow does not use PII or sensitive customer data to train or fine-tune AI models. AI workflows use retrieval-augmented generation with controlled prompts that reference case data at runtime, and process it only to generate outputs for the requesting customer.
- No automated decisions affecting consumers: the platform provides analysis and workflow automation; final decisions remain with the merchant.
- Runtime guardrails: every model in production is subject to input and output guardrails, including PII detection, content moderation, jailbreak and prompt-injection detection, hallucination detection, URL filtering, and organization-specific prompt policies. Deployed models are continuously monitored for quality, latency, error rates, and anomalous usage.
Secure development
- Annual third-party penetration testing (report available at the Trust Center).
- Security-integrated SDLC with strict environment separation and secrets managed through AWS SSM Parameter Store and Secrets Manager.
- Pre-commit secret scanning and CI gating: automated tests, dependency scanning that blocks high/critical vulnerabilities, static analysis, and peer review before merge.
- Daily vulnerability triage and prioritized remediation.
Subprocessors
The complete, up-to-date list of subprocessors is published at trust.chargeflow.io/subprocessors. If a DPA is in place between us, it also includes the subprocessor list as an annex.
Incident history
Incident history is published and kept current at the Trust Center and status.chargeflow.io.
Requesting documents or reporting an issue
- Security documents (SOC 2 report, penetration test, DPA, subprocessor list): request access through the Trust Center.
- Security questions or vulnerability reports: contact support@chargeflow.io or your account team.