Encrypted connections
HTTPS with HSTS protects traffic to Fencia. The edge accepts TLS 1.2 and 1.3; the service does not claim to use TLS 1.3 exclusively.
Trust / Security
Last updated: October 11, 2026
Know how Fencia handles your evidence.
Before connecting sources or uploading policies, you should know what is stored, who processes it and where the current controls stop. This page describes the product’s documented security posture.
Ask a security questionCurrent data pathFencia
DatabaseSupabase in AWS Frankfurt; encrypted at rest
AnalysisAn external AI provider processes submitted document content
Document storageScan-only inputs are temporary; documents saved in Files persist until deletion
ResultsFindings and supporting quotations remain in the account
Technical controls
What is in place today.
These are specific controls visible in the current implementation and product audit. Your vendor review should still consider the limits below.
Database protection
Supabase encrypts stored data with AES-256. Row-Level Security restricts access to user data at the database level.
Document handling
Files submitted only for analysis and their full extracted text are not saved in analysis history. Findings may contain quotations. Documents saved in Files persist in the workspace until you delete them.
Account access
Sign-in is managed through Supabase Auth with rate limiting. Two-step verification with an authenticator app is available in Settings. An owner or admin can require it for a workspace.
Evidence requests
When responding to an evidence request, the attachment passes temporarily through the Fencia server and is forwarded through the email provider to the requester. Fencia does not retain the file: it stores its name, size, type and SHA-256 fingerprint, together with submitted notes and links. Before sending, the person receiving the request should check who the requester is and whether sharing the information is appropriate. The email provider and the requester’s mailbox may retain the attachment under their terms and settings.
Spending import
During spending import, the bank or card statement is read in your browser. When you confirm your selection, the server receives only aggregates for the selected tools: catalog identifier, charge and month counts, first and last detected dates, and totals by currency. These summaries are saved in the inventory; the statement file and its full transaction rows are not sent.
AI processing
A document is processed, then a result is kept.
Fencia does not train its own models on customer documents. Analysis uses the external provider named in the register. That provider's use and retention of submitted data depend on the applicable API tier and agreement. Review those terms before submitting sensitive material.
- 01 / INPUTYou submit a document, URL or a permitted connected source.
- 02 / ANALYSISText is sent to the AI analysis provider to produce possible findings and supporting passages.
- 03 / RESULTAnalysis history does not retain the original file or full extracted text; findings may contain quotations.
Saving a document in Files is a separate, persistent action. Its Markdown content remains in your workspace until deletion, and PDF or DOCX downloads are generated from that content. Keep your original source documents for verification.
Data locations
Who helps deliver the service.
The application database is in an EU region. Providers for hosting, AI analysis, payments and email may process data outside the EEA. Open the register for names, purposes and listed safeguards; confirm contractual transfer details in the applicable agreement.
View provider register and locations
| Provider | Purpose | Listed location | Listed safeguard |
|---|---|---|---|
| Supabase | Database and authentication | EU (AWS Frankfurt) | EU region |
| Vercel | Application hosting | EU / USA | SCCs |
| Microsoft (Azure AI Foundry · modelo DeepSeek) | AI document analysis (text only; images are read first by our own OCR; partial identifier pseudonymisation before sending, not anonymisation) | EU (EU Data Zone) | EU-only processing · Microsoft DPA |
| Paddle | Payments, taxes and invoices as reseller | UK (headquarters) | Independent controller; see its policy |
| Resend | Transactional email | USA | SCCs |
| Cloudflare (Turnstile) | Bot protection on forms | Global | SCCs |
| Vercel Analytics | Aggregated usage metrics, no cookies | USA | SCCs |
| GitHub Actions (backups) | When backups are enabled: temporary dump processing on the runner and encrypted artifact retention for up to 30 days; first backup and restore verification still pending | Runner and storage locations to be confirmed | Artifact encrypted with age; agreement and transfers to be confirmed |
Current limits
What a buyer should still ask.
- Two-step verification (authenticator app) is available to every user, and an owner or admin can make it mandatory for a whole workspace; the database itself refuses a session that has not passed it. Signing in through your company's identity provider is not available yet. Ask about account access before onboarding a wider team.
- No independent security certification is claimed. Fencia does not hold ISO/IEC 42001 or SOC 2 certification.
- Deletion and audit trails have defined limits. Results can contain quotations, logs are not immutable, and production deletion behavior should be confirmed for your account.
- International transfers need contractual review. Discuss a DPA and verify provider transfer terms before uploading regulated data.
Vendor review
Have a specific security requirement?
Tell us what your DPO or security team needs to verify. Contact contact@fencia.co or use the form to discuss current controls and contractual documents.
Contact Fencia