Data and hosting
The application, database and document storage run on Microsoft Azure in Sweden Central. The frontend runs on Vercel. AI processing uses Google Cloud Vertex AI in the Netherlands. The subprocessor list sets out locations and any transfers outside the EEA for each service.
Document processing
Chainfill receives documents, extracts data and checks it according to your configuration. Data goes to your TMS, ERP or WMS after approval or through configured automatic export. For mailbox integrations, we agree which folder is processed.
View the technical processing pathRetention and deletion
We retain documents, email content, extraction results and processing history to provide the service and support review. Exporting does not automatically delete this data. You can request deletion. At the end of the service, customers choose return or deletion, subject to legal retention requirements. The data processing agreement and privacy policy set out the arrangements.
Privacy policyAccess, isolation and encryption
Access to customer data is scoped to the company and the user’s permissions.
Customer separation
Customer data is logically separated on shared infrastructure. Authorisation and company-scoped access controls restrict which data a user can access.
Sign-in and permissions
Accounts are invitation-only, with role-based permissions. Each user can enable multi-factor authentication. Single Sign-On is an Enterprise option and follows your identity provider’s authentication policies.
Encryption
Stored data is encrypted with AES-256. Data is encrypted in transit over HTTPS.
Audit logging
Important changes to documents, workflows, settings and permissions are recorded with the user and timestamp. Processing and export history support review and troubleshooting.
Security testing and certification
Changes go through code review and automated tests. We use automated security checks and engage external testing of the platform.
ISO 27001
Published status on 3 August 2026: certification in progress, not yet certified. The scope covers development, operation and support of the Chainfill platform. Contact us for the current status and available evidence.
External penetration test
WYKYK has completed the external penetration test. All findings from this test have been resolved. The report is available on request.
About WYKYKAvailability and incident handling
The SLA and data processing agreement set out availability, support and data breach notification arrangements.
- Availability
- The SLA sets a 99.5% monthly availability target under the agreed measurement method. It also sets out the conditions for service credits.
- Support
- The service window is Monday to Friday, 09:00–18:00 Netherlands time, excluding public holidays. The SLA describes priorities and response times.
- Data breach notification
- We report a data breach without undue delay after becoming aware of it, within 24 hours wherever possible, as set out in the data processing agreement. The notification includes available information and a contact point for follow-up.
- Backups and recovery
- Backups are encrypted and stored separately from production. Point-in-time recovery is available. During onboarding, we agree a fallback scenario for your document processing based on your TMS or WMS and volumes.
- Exit and data portability
- At the end of the service, you can choose return or deletion of your data, subject to legal retention requirements. Export is available in XML, JSON, CSV and Excel.
NIS2 supplier assessment
Assessing Chainfill as a supplier for NIS2? You can request our completed security questionnaire, technical overview and NIS2 supplier annex. The annex describes notification windows, security commitments and audit and evidence rights.
AI and your data
Read how company-specific memory, model training, human review and automatic export are handled.
Security questions
Contact us with questions about Chainfill security or to request supporting evidence.