Security overview for your records

Service	Pingtail: document requests, reminders and upload checks for bookkeeping, accounting and tax firms
Provider	Pingtail Partners, NH231, Above Axis Bank, Gulabbagh, Purnia, Bihar 854326, India
Hosting	Application and database in the EU (Finland)
Encryption in transit	TLS on all traffic between browsers and the service
Encryption at rest	Every uploaded file is encrypted by the application with AES-256-GCM before it reaches storage
Two-step login	Available to every firm user. The firm owner can require it for the whole firm.
Breach notice	Without undue delay, and within 72 hours of becoming aware
Certifications	None. We do not hold SOC 2 or ISO 27001 certification.
Security contact	dipa@pingtail.com

This overview describes the service as it is today. It is not a certification and it is not legal advice. Your firm remains responsible for its own security plan. The contract terms are in the Data Processing Agreement.

1. What Pingtail stores

Data	Details
Your firm's account	Firm name and settings, team members' email addresses and roles, password hashes, and billing records. Our payment processor handles card details. We do not see or store full card numbers.
Your clients' contact details	Names, email addresses and phone numbers you enter or import.
Requests and messages	What you asked for, the reminders sent, and the replies.
Uploaded documents	The files and answers your clients provide. These may include bank statements, payslips, tax forms and ID documents.
Logs	An audit log of views, downloads, accepts, send-backs and deletions, and of sign-in security events. Technical data such as IP address, browser type and times.
Connections you set up	An encrypted access token for each service you connect. Nothing else from that service's account.

2. Where it is hosted

Our application server and database are hosted in the EU (Finland). The encrypted files are kept with an S3-compatible storage provider that holds ciphertext only. All firms are hosted in the same region. There is no choice of region today.

Transfers outside the UK and the European Economic Area may occur for email delivery and AI checks. We make them only with a safeguard that data protection law accepts, such as standard contractual clauses or the provider's equivalent.

3. Encryption

In transit. All traffic between browsers and the service uses TLS.
Files at rest. The application encrypts every file with AES-256-GCM before it reaches storage. Each file has its own key. A master key wraps the file keys and is kept apart from the stored files. The storage provider holds only ciphertext.
Secrets at rest. Access tokens for connected services and two-step login secrets are encrypted the same way, each bound to the firm or person it belongs to.
Passwords. Hashed with argon2id. We never store them in readable form.
Links, sessions and recovery codes. Stored only as hashes, so a copy of our database does not reveal working ones.
Backups. We take encrypted backups of the database every night, and keep the newest 14.

4. Access controls and two-step login

Roles. Each person in your firm has their own login and one of three roles. The owner handles billing and can hand the firm to someone else. Admins change settings, templates, connections and the team. Staff work with clients, requests and review. A signed-in person only ever reaches their own firm's data.

Two-step login. A firm user can add a second step to their login: a 6-digit code from an authenticator app (TOTP, RFC 6238).

It is switched on only after a code from the app has been checked.
The code is asked for after a password and after an emailed sign-in link. The link alone does not sign anyone in when two-step login is on.
The firm owner can require two-step login for everyone in the firm. A member without it must set it up at their next login, before the app opens.
10 one-time recovery codes are shown once at setup. We store only hashes of them.
A person can choose to have a browser remembered for 30 days. The record is kept on our server, and the person can remove it at any time.
After 5 wrong codes in a row, the second step is locked for 15 minutes and the person is told by email.
The owner or an admin can reset a team member's two-step login. An owner who has lost both the phone and the recovery codes goes through support: we check identity in a second way, then wait 72 hours and notify the firm before the reset. An email alone is never enough.
Two-step login applies to the people in your firm. Your clients have no account to protect: they open a private link, described below.

Passwords and sessions. Passwords need at least 12 characters. After 10 failed logins the account is locked for 15 minutes. A session ends after 14 days. Each person can see their signed-in sessions, end any of them, and sign out everywhere. Changing a password signs out every session.

Sensitive actions. A person with two-step login must enter a fresh code before connecting or disconnecting a service, changing roles or the firm's owner, changing the firm's two-step rule, resetting a member's two-step login, switching their own off, or closing the account. A code covers 10 minutes. A password reset on such an account also needs a code.

Client links. Clients open a private link from a message. They need no account and no password. Each link is a long random token bound to one request. If it is opened on a second device, that device must enter a code that we send to the client's email.

Storage and our own staff. The storage bucket is private. Downloads go only through the application, for a signed-in member of the firm that owns the file. Only the few people who run the service can reach the servers. We open a customer's documents only when the customer asks us to, for support.

Audit log. Every setup, switch-off, reset, recovery-code use, lockout and rule change for two-step login is written to the audit log, with views, downloads, accepts, send-backs and deletions. While your account is open, audit entries are not deleted on a schedule, so the last 13 months are always there. You can ask us for an extract at dipa@pingtail.com.

5. Sub-processors

These are the categories in Annex 3 of the Data Processing Agreement. The current named list is available on request at dipa@pingtail.com. We give notice at least 14 days before we add or replace one.

Category	What it does	Client data involved
Cloud hosting (EU)	Runs the application and database	Client contact details, request data, logs and encrypted backups
S3-compatible object storage	Stores uploaded files	Ciphertext only. The provider cannot read the files.
Transactional email delivery	Delivers requests, reminders and codes	Client name, email address and the content of the email
WhatsApp Business Platform (Meta Platforms), only for firms that connect WhatsApp	Delivers the firm's requests and reminders on WhatsApp from the firm's own number, and returns the client's replies	Client name, phone number, the content of the message and the client's replies and files
AI model provider for document checks (Anthropic)	Reads a document to check if it matches what was asked. Not used to train models. The firm can switch this off.	The content of the uploaded document

Our payment processor (PayPal) handles firm subscriptions only. It does not receive client data.

Services you connect yourself (Google Drive, Dropbox, Xero, QuickBooks Online, Slack, Zapier or your own webhook address) are not our sub-processors. When you connect one, you instruct us to send the data you select to it, and that service's own terms apply.

6. Retention and deletion

Your firm sets how long files are kept. The default is 7 years on paid plans. On a read-only account (no active plan), files are deleted 90 days after a request is completed.
You can delete any file, request or client, or your whole account, at any time. Deletion removes the stored object and its encryption key, so the file cannot be recovered.
You can download all your files at any time, on every plan.
When an owner deletes the firm, the owner can undo it for 30 days; after that we erase the firm's files and its clients' details, and an anonymised record of actions stays, unless the law requires us to keep more.
Accounts with no login for 12 months are archived and their files deleted after a warning email.
Encrypted backups expire on their normal schedule, not at the moment of deletion. They are not used to restore deleted data, except to recover from an incident.
Files already saved into a service you connected are held by that service under your own account. Deleting a file in Pingtail does not delete that copy.

7. Breach notification

If a breach affects your client data, we notify you without undue delay, and in any case within 72 hours of becoming aware. We tell you what we know: what happened, the data and people likely affected, the likely effects, and what we are doing about it. We send updates as we learn more, and we help you meet your own duties to notify. This is section 9 of the Data Processing Agreement.

8. How to disconnect a connected service

Sign in as the owner or an admin and open Integrations.
Press Disconnect on the service. If you have two-step login, you enter a code first.
We ask the service to revoke our access and delete our copy of the access token. Files still waiting to be sent are marked as not delivered.

Files already saved in that service stay there, under your account. Pingtail only ever adds to a service you connect: it never deletes, moves or renames anything in it. You can also remove Pingtail from inside the service itself.

9. What is not in place

No SOC 2 report and no ISO 27001 certificate.
No independent penetration test has been carried out.
No single sign-on (SAML, or sign-in with Google or Microsoft).
No choice of hosting region. The application and database are hosted in the EU (Finland).
No staffed, round-the-clock monitoring team.
No published recovery time target.
We rely on our providers' own security reports. We do not audit them ourselves.

10. Contact

Security questions, questionnaires and reports: dipa@pingtail.com. General support: dipa@pingtail.com. We answer reasonable security questionnaires from customers. More detail: the Security page, the Privacy Policy and the Data Processing Agreement.

Pingtail Partners, NH231, Above Axis Bank, Gulabbagh, Purnia, Bihar 854326, India · +91 91801 85753 · dipa@pingtail.com