Security and compliance

GDPR
EU hosting
ISO 27001 - in progress
Pentested by WYKYK
NIS2 supplier
EU AI Act

99.5%

Contractually guaranteed availability

24 hours

Maximum notification window for a data breach

Security incidents affecting customer data, as at August 2026

Processing and storage inside the European Union

Data and hosting

The main application, the relational database and document storage run on Microsoft Azure in West Europe. The public frontend runs on Vercel. AI processing runs on Google Cloud Vertex AI in the Eemshaven data centre in the Netherlands.

The processing path

The exact workflow is configured per customer and document type. Technically the path looks like this.

Intake
Email via Microsoft Graph or IMAP, manual upload, API, SFTP or webhook. With mailbox integration we process only an agreed folder or subfolder.
Capture
Metadata and email content are recorded in PostgreSQL. Files and converted documents go to Azure Blob Storage.
Pre-processing
Attachments are read, converted to PDF or text where needed, and enriched with technical metadata and extracted text.
AI processing
Classification selects the document type and configuration. The extraction result and technical output are written back to the database.
Enrichment and validation
Business rules, reference tables, type validation, supplier recognition and human review correct and enrich the data.
Export
Approved data is mapped to XML, JSON, CSV or Excel and delivered via REST API, SFTP, email or manual download. Your TMS, ERP or WMS remains the system of record.

Where data rests along the way

For completeness, these are all the intermediate storage points.

The customer mailbox
Chainfill PostgreSQL
Azure Blob Storage
Temporary cache and queue infrastructure for asynchronous processing
The selected AI provider during inference
The destination system

What we retain, and why

We do not store only the extracted fields. The data model holds the subject, full body, HTML rendering, sender and recipients, attachment metadata and optionally the raw email. Attachments are stored as separate records. That means attachments which later turn out to be irrelevant can also be fetched and stored within the processed mailbox scope. Mailbox integration can therefore be limited to an agreed folder, and irrelevant attachments can be deleted.

After a successful export, extraction results, versions, validation results, export payloads and request and response logs remain available. This supports review, version history, error analysis, auditability, resending and update detection. Orders a user marks as a learning example move to the company memory. Other data can be deleted on request, at the cost of reduced auditability.

Access, isolation and encryption

Every customer is a separate tenant. Access is enforced and logged at several layers.

Multi-tenant isolation

Chainfill is a multi-tenant platform with logical, application-wide separation per company. Core records carry a company relation; request context, tenant-scoped querysets, permission checks and explicit company validation constrain access. Sensitive operations carry additional guards against mixed-company operations. This is not a physically separate database or dedicated infrastructure per customer: the separation is logical, through tenant IDs, authorisation, RBAC and scoped queries within shared platform infrastructure.

Authentication

Role-based access control with fine-grained rights per role and section. Account management is invitation-based; there is no self-registration. Multi-factor authentication (TOTP) is available to every user and is enabled per user. Single Sign-On via WorkOS is an Enterprise option configured per organisation; with it, your own identity provider's authentication and MFA policy applies.

Encryption

AES-256 for data at rest and HTTPS with TLS 1.3 and Perfect Forward Secrecy in transit. Production infrastructure refuses unencrypted ingress. File storage runs over HTTPS with managed identity; secrets live in Azure Key Vault. Specific sensitive database fields carry additional Fernet encryption.

Audit logging

Material changes to document data, statuses, workflows, configurations, roles and credentials are logged with actor, timestamp and field change. Workflow executions and export attempts carry their own status and request and response history.

No subcontractors

Chainfill does not use subcontractors or freelancers with access to customer environments or to the code.

Backups

Backups are encrypted and stored separately from the production environment. Point-in-time recovery is available.

Development and security testing

Every change to Chainfill runs through a fixed chain of reviews and automated tests before it reaches production.

Pull request required

Main only accepts pull requests, with backend and frontend tests, type checks, linting, integration tests, synthetic tests, workflow replays and a preview environment per change.

Risk-based review gate

P0 paths are the mission-critical code paths for identity and tenant isolation, document and workflow processing including export, and the core Dashboard and Inspect routes. Changes there fall under CODEOWNERS and require a current approval from the P0 review team. A new push invalidates any earlier approval.

Automated security testing

Bandit SAST runs on every backend PR. On top of that, a nightly repository-wide security audit workflow covers the full codebase.

Vulnerability scanning

Continuous vulnerability scanning across all systems, plus daily automated penetration testing with our own tooling.

External penetration test

Alongside our own tooling we have penetration testing carried out by WYKYK, a Dutch offensive security firm that is itself ISO 27001 and ISO 9001 certified. The engagement is under way. We share the report with customers on request under NDA.

wykyk.com

Certification and assurance

We state exactly where we stand. No marks we do not yet hold.

ISO 27001

In progress

Chainfill is in the ISO/IEC 27001 certification track. An external ISO consultant guides the process, the gap analysis is under way and the certification body selection is in progress. We have contractually committed to existing customers that certification is in place before 1 January 2027.

Scope of the management system

The information security management system supporting the development, operation, maintenance and support of the Chainfill SaaS platform for AI-driven document and data processing for logistics and supply chain customers, including customer onboarding and support, operated from the head office in Haarlem, the Netherlands.

Penetration test

Under way

External penetration test by WYKYK, on top of continuous internal scanning. Report available on request under NDA.

SOC 2

Not applicable

Chainfill holds no SOC 2 report and has none planned. Our customers are in the EU and assess against ISO 27001; that is where we put our resources.

Incident history

As at August 2026: there have been no security incidents or data breaches affecting customer data.

Availability and continuity

If Chainfill stops, your order processing stops. That is why we put availability and notification windows in the contract.

View live status

Availability: Contractually 99.5% per month, measured over working days. In practice we achieve 99.9%. Current status is available live.
Service window: Monday to Friday from 09:00 to 18:00 Netherlands time, excluding public holidays. Incidents are classified P1 through P4, each with its own response time.
Breach notification within 24 hours: We report a data breach without undue delay and in any case within 24 hours of becoming aware of it wherever possible. That is deliberately shorter than the 72 hours the GDPR gives you towards the regulator, so you stay inside your own deadline.
Outage and fallback: During a platform outage the intake paths stay separate from processing: orders can be uploaded manually or delivered by email and are processed once service is restored. We work out the concrete fallback scenario with you during onboarding, matched to your TMS and volumes.
Exit and data portability: As soon as we no longer need the data we delete it or return it, at your choice. Export is available in XML, JSON, CSV and Excel, the same formats as during the term.

Read the full SLA

NIS2 and the Dutch Cybersecurity Act

The Cyberbeveiligingswet, the Dutch implementation of NIS2, enters into force on 15 August 2026 with no transition period. Transport is a designated sector, so many of our customers fall within scope. Those in scope must assess the security of their direct suppliers. Chainfill is that supplier. This page exists so that assessment can be completed in one pass.

Our measures, mapped to the ten NIS2 categories

Risk analysis and information security policy
Being formalised in the ISO 27001 management system now being built, with a defined scope and an external gap analysis.
Incident handling
Monitoring via Datadog, automated alerts, a fixed support channel with P1 through P4 classification and a contractual 24-hour notification window.
Business continuity and backup
Encrypted, separated backups with point-in-time recovery, geo-redundant storage and fallback scenarios agreed per customer.
Supply chain security
A public, current subprocessor list with location and transfer mechanism, contractual equivalence requirements on every subprocessor and a ten working day objection window on changes.
Security in acquisition, development and maintenance
Mandatory pull requests, a CODEOWNERS gate on P0 paths, SAST in CI, preview environments and a deterministic replay simulation of the full document flow.
Assessment of effectiveness
Continuous vulnerability scanning, a nightly repository-wide security audit and an external penetration test by WYKYK.
Cyber hygiene and training
Information security and confidentiality policy and training for the whole team, which works from a single site in Haarlem.
Cryptography
AES-256 at rest, TLS 1.3 with Perfect Forward Secrecy in transit, secrets in Azure Key Vault and additional field-level encryption on sensitive database columns.
Access control and asset management
Role-based access control, tenant-scoped queries, invitation-based account management and audit logging on every material change.
MFA and secured communications
Multi-factor authentication (TOTP) available to every user, Single Sign-On as an Enterprise option so your own identity provider enforces MFA policy, and encrypted communication on every interface.

What it comes down to: the reporting chain

If you fall under NIS2, you must report a significant incident to your regulator within 24 hours and file a full notification within 72 hours. That only works if your supplier is fast. Our data processing agreement fixes a notification window of at most 24 hours, deliberately chosen to sit inside your NIS2 clock. You get a named point of contact and an escalation path.

NIS2 supplier annex

For customers within scope of the Cyberbeveiligingswet we have a signable annex covering notification windows, security commitments and audit and evidence rights. Request it from the documents page.

Request documents

Our own position

Chainfill is a Dutch software supplier with a team of four at a single site in Haarlem. In our customers' supply chain we are a direct supplier, and that is the role this page is built around. ISO 27001 certification, planned before 1 January 2027, is the evidence that lets you close your assessment fastest.

AI and the EU AI Act

The AI Act has been largely applicable since 2 August 2026. Chainfill runs its AI models on Google Cloud in the Netherlands, does not train on customer data, and puts human review in front of every extraction by default.

Read our AI disclosure

Subprocessors

The full, current list of subprocessors with name, location, service and transfer mechanism. We notify you before any change and you have ten working days to object.

View the subprocessor list

Documents

Data processing agreement, SLA, AI addendum, NDA, technical overview, NIS2 annex and our pre-filled security questionnaire.

Request documents

Frequently asked questions

Where does our data live?

Inside the European Union. The application, database and document storage run on Microsoft Azure in West Europe. AI processing runs on Google Cloud Vertex AI in Eemshaven, the Netherlands. Monitoring runs on Datadog in the Netherlands. A small number of subprocessors for analytics and internal operations process (partly) outside the EEA, each under a valid transfer mechanism; all are named with their location and mechanism on the subprocessor page.

Do you train AI models on our data?

No. We did not do so over the past year and do not do so today. Chainfill learns only through company-specific context and memory, which never generalises to another customer. Our agreement reserves the right to use data to improve the service, including model training, so that we can do so for your organisation if you ask us to. We do not act on that without you and never for the benefit of another customer.

Are you ISO 27001 certified?

Not yet. We are in the certification track, with an external consultant, a defined scope and a certification body selection in progress. We have contractually committed to existing customers that certification is in place before 1 January 2027.

Has the platform been externally tested?

Yes. Alongside continuous vulnerability scanning and daily automated penetration testing with our own tooling, we have penetration testing carried out by WYKYK. We share the report on request under NDA.

How quickly do you report a data breach?

Without undue delay and in any case within 24 hours of becoming aware of it wherever possible. That is written into the data processing agreement and is deliberately shorter than the 72 hours the GDPR gives you towards the regulator.

What availability is guaranteed?

Contractually 99.5% per month, with service credits if that is structurally missed. In practice we achieve 99.9%. Current status is at status.chainfill.ai.

Do we get a data processing agreement?

Yes. The data processing agreement is annex 5 to the SaaS agreement and meets Article 28 GDPR, including instruction authority, confidentiality, security measures, subprocessors and audit rights. Also available as a standalone document.

What happens to our data if we stop?

As soon as we no longer need the data for the service, we delete it or return it, at your choice, save for statutory retention duties. Export is available in XML, JSON, CSV and Excel.

Are you NIS2 compliant?

NIS2 places obligations on the organisations within its scope, not on their software suppliers as such. What matters is that you, as an in-scope organisation, must assess your direct suppliers. We supply the evidence for that: the measure mapping on this page, a 24-hour notification window, a public subprocessor list and a signable NIS2 annex.

How do we report a vulnerability?

Email security@chainfill.ai with a description and reproduction steps. We confirm within two working days. Anyone who follows the ground rules on this page has nothing to fear from us legally.

Questions or a report

For security questions, questionnaires and vulnerability reports there is one fixed address.

Questions or a report

security@chainfill.ai

Responsible disclosure

If you find a vulnerability, report it to us before sharing it elsewhere. Stay within the minimum needed to demonstrate the issue, do not touch anyone else's data, change or delete nothing, and do not run denial-of-service, phishing or physical attacks. We confirm your report within two working days and keep you posted until it is resolved. Anyone who follows this has nothing to fear from us legally. We do not run a bug bounty programme.