Security and Data Protection

PROFORMAL PDF CONVERTER: SECURITY AND DATA PROTECTION
Version: 1.0
Effective Date: June 11, 2026

1. OUR SECURITY PHILOSOPHY
At ProFormal, we understand that financial data, including bank statements, invoices, and commission statements, is highly sensitive. Our platform was architected from the ground up with a "privacy-by-design" and "zero-trust" philosophy. We believe the safest way to protect your clients' financial data is simply to not store it.
This document outlines the technical and organizational safeguards we have implemented to ensure compliance with the South African Protection of Personal Information Act (POPIA) and international best practices.

2. EPHEMERAL DATA PROCESSING (ZERO RETENTION)
Unlike traditional cloud storage platforms, ProFormal operates strictly as a data processing engine.
In-Memory Processing: When you upload a PDF document for conversion, the extraction is primarily handled in secure, isolated memory.
Auto-Purge Protocol: Any files that must be temporarily written to disk for processing are subjected to strict ephemeral storage rules. Original uploads and converted output files (CSV/Excel) are automatically, permanently shredded and purged from our servers within 24 hours of processing.
No AI Training: We do not use your financial documents or extracted data to train public or proprietary Artificial Intelligence (AI) models.

3. ENCRYPTION & DATA TRANSMISSION
We utilize bank-grade encryption to ensure your data remains secure while in transit and during its temporary processing window.
In Transit: All communications between your browser and the ProFormal servers are encrypted using modern Transport Layer Security (TLS 1.2/1.3). We enforce strict HTTPS across all application endpoints.
At Rest: Any temporary files or metadata stored in our databases (such as account details or billing history) are encrypted at rest using industry-standard AES-256 encryption.

4. PAYMENT & BILLING SECURITY
ProFormal does not process, transmit, or store your raw credit card information.
PCI-DSS Compliance: All subscription payments, prepaid wallet top-ups, and card verifications are securely handled by Paystack, a fully PCI-DSS Level 1 certified payment gateway.
Tokenization: Our databases only store secure, anonymized billing tokens that allow us to trigger recurring subscription charges without ever having access to your actual card number or CVC.

5. INFRASTRUCTURE & ACCESS CONTROLS
Our production environment is built on trusted, enterprise-grade cloud infrastructure with strict access limitations.
Principle of Least Privilege: System access is restricted to essential engineering personnel only. Access requires multi-factor authentication (MFA) and occurs through secure, encrypted VPN tunnels.
Zero Employee Access to Documents: ProFormal employees and support staff cannot view, download, or access the contents of the PDFs you upload.
Support Ticket Isolation: If a document fails to parse and you explicitly choose to submit it to our engineering team via the "Report Issue" tool, that specific file is isolated in a secure, restricted queue for parser development and is strictly bound by our internal confidentiality agreements.

6. COMPLIANCE WITH POPIA
As a South African company, ProFormal strictly adheres to the Protection of Personal Information Act (POPIA).
Information Officer: We maintain a registered Information Officer to oversee compliance and handle Data Subject Access Requests (DSAR).
Breach Notification: In the highly unlikely event of a verified data compromise, we maintain a strict protocol to notify the Information Regulator and affected organizations within 72 hours, as mandated by POPIA.

7. VULNERABILITY MONITORING
Continuous Monitoring: Our server environments are continuously monitored for unusual activity, brute-force attempts, and unauthorized access.
Isolated Execution: Document processing occurs in isolated, sandboxed environments to prevent malicious files from impacting the core application infrastructure.