# Security & compliance (https://docs.chargeflow.io/docs/reference/security)
Chargeflow follows enterprise-grade security and compliance practices for handling financial and customer data. This page summarizes our posture and links to the canonical source for every report and policy.
The [Chargeflow Trust Center](https://trust.chargeflow.io/) is the single source of truth for our
certifications, security policies, and data-privacy documentation, including the SOC 2 Type II
report, penetration test report, and DPA. Access to gated reports is granted on request.
## Certifications & compliance [#certifications--compliance]
| Standard | Status |
| ------------------------- | ----------------------------------------------------------------------------------- |
| SOC 2 Type II | Certified - current attestation at the [Trust Center](https://trust.chargeflow.io/) |
| GDPR | Compliant |
| ISO 27001 / 27017 / 27018 | Planned - current status at the [Trust Center](https://trust.chargeflow.io/) |
| CCPA | Planned - current status at the [Trust Center](https://trust.chargeflow.io/) |
| PCI DSS | Not held (see below) |
**On PCI DSS:** Chargeflow does not store raw PAN (full card numbers) and does not operate as a cardholder-data environment, so a PCI attestation is generally not applicable. Chargeflow may ingest non-sensitive card-related dispute attributes exposed by your payment processor, such as BIN, last four, brand, expiration metadata, and AVS/CVV results, when needed to build evidence.
All certificates and reports are available at [trust.chargeflow.io](https://trust.chargeflow.io/).
## Data handling & privacy [#data-handling--privacy]
* **What we process:** the customer, transaction, dispute, and enrichment data needed to automate dispute management (names, contact details, order and transaction metadata, reason codes and deadlines, evidence files, and related signals).
* **What we do not store:** raw PAN / full card numbers.
* **Roles under GDPR:** Chargeflow acts as a data processor on your behalf; you remain the data controller. Data-subject requests are handled per the Data Processing Agreement, and transfers out of the EEA are covered by Standard Contractual Clauses.
* **Encryption:** all data in transit is encrypted with TLS 1.2 or higher; all data at rest is encrypted with AES-256 or equivalent.
* **Authentication:** all user accounts require MFA. See [Authentication](https://docs.chargeflow.io/docs/reference/api-fundamentals/authentication) for API key and HMAC options.
* **Historical data:** Chargeflow ingests roughly the past 24 months of chargeback data from connected processors.
Data Processing Agreements and the full privacy documentation are available at [trust.chargeflow.io](https://trust.chargeflow.io/).
## Hosting & availability [#hosting--availability]
* **Infrastructure:** single-tenant on AWS, primary region `us-east-1`. Specific regional data-residency requirements can be reviewed and supported on request.
* **Availability:** contractual uptime SLAs are set per agreement; live availability is published at [status.chargeflow.io](https://status.chargeflow.io/).
* **Disaster recovery:** RPO of 6 hours, RTO of 24 hours. As a pure cloud platform, Chargeflow can redeploy to any available AWS region.
* **Scalability:** serverless architecture with no practical limit on accounts, processors, merchants, or dispute volume.
Live status is published at [status.chargeflow.io](https://status.chargeflow.io/).
## AI governance & data use [#ai-governance--data-use]
* **No training on your data:** Chargeflow does not use PII or sensitive customer data to train or fine-tune AI models. AI workflows use retrieval-augmented generation with controlled prompts that reference case data at runtime, and process it only to generate outputs for the requesting customer.
* **No automated decisions affecting consumers:** the platform provides analysis and workflow automation; final decisions remain with the merchant.
* **Runtime guardrails:** every model in production is subject to input and output guardrails, including PII detection, content moderation, jailbreak and prompt-injection detection, hallucination detection, URL filtering, and organization-specific prompt policies. Deployed models are continuously monitored for quality, latency, error rates, and anomalous usage.
## Secure development [#secure-development]
* Annual third-party penetration testing (report available at the Trust Center).
* Security-integrated SDLC with strict environment separation and secrets managed through AWS SSM Parameter Store and Secrets Manager.
* Pre-commit secret scanning and CI gating: automated tests, dependency scanning that blocks high/critical vulnerabilities, static analysis, and peer review before merge.
* Daily vulnerability triage and prioritized remediation.
## Subprocessors [#subprocessors]
The complete, up-to-date list of subprocessors is published at [trust.chargeflow.io/subprocessors](https://trust.chargeflow.io/subprocessors). If a DPA is in place between us, it also includes the subprocessor list as an annex.
## Incident history [#incident-history]
Incident history is published and kept current at the [Trust Center](https://trust.chargeflow.io/) and [status.chargeflow.io](https://status.chargeflow.io/).
## Requesting documents or reporting an issue [#requesting-documents-or-reporting-an-issue]
* **Security documents** (SOC 2 report, penetration test, DPA, subprocessor list): request access through the [Trust Center](https://trust.chargeflow.io/).
* **Security questions or vulnerability reports:** contact [support@chargeflow.io](mailto:support@chargeflow.io) or your account team.
## Related [#related]
Short answers to common security, data, and privacy questions
API keys, HMAC signatures, and key management
Certifications, reports, and policies
Reach the Chargeflow team