A simple premise
When you entrust us with your data — supplier invoices, contracts, payments, SaaS subscriptions — you’re handing over what your company has that’s most sensitive. Not just because the law requires protection, but because these documents tell, better than any report, how your business actually operates, who your partners are, and where you’re vulnerable.
That’s why we built Finareo around one rule: security must be baked into the architecture, not written into a policy. Here’s concretely how that plays out.
1. Your data stays in your geographic zone
For our Moroccan clients, your data is hosted in Morocco at N+ONE, a Tier III datacenter compliant with CNDP requirements. For our European clients, hosting is in the European Union (Germany or Finland) at an ISO 27001-certified operator.
In both cases, your data never leaves its geographic zone for storage. GDPR (or Moroccan data protection law) applies in full, depending on your situation.
2. Encryption, always
Your data is encrypted in transit (between your browser, our servers, and all our subprocessors) via TLS 1.3 — the most recent encryption standard. It’s also encrypted at rest, on the disk of our servers.
Concretely: if someone intercepted our communications, they’d see only noise. If someone physically obtained our disks, they could read nothing.
3. Strict technical isolation
Each client has a technically separate storage space, in a distinct database schema. This is a strong architectural choice: even in case of a bug in our software, one client’s data cannot be returned to another. It’s not a policy — it’s a technical impossibility.
On the team side, only people authorized for your file can access your data. All their actions are logged in a journal you can review on request. Your data is never used for commercial, marketing, or resale purposes.
4. AI, properly fenced in
To analyze your documents, we use external AI models (OpenAI, Anthropic). But with two key protections:
- Automatic anonymization before every call: supplier names, bank account numbers, contacts, VAT numbers are replaced with tokens (
SUPP_001,IBAN_017). The AI sees the document’s structure and amounts, but never who is who. - Contractual Zero Data Retention: our enterprise contracts with OpenAI and Anthropic include a clause forbidding any retention of sent data. No model training, no history. Each analysis is stateless.
5. If something goes wrong, you’ll know
If an incident affects your data, you’ll be notified within 72 hours maximum (GDPR requirement), with three clear pieces of information:
- What happened
- What it means for you
- What we’re doing about it
A detailed report follows within 7 days. No vague communication, no PR-speak.
We don’t just check ourselves. You can verify too.
Our architecture is aligned with the ISO 27001 standard — meaning the controls expected for certification are already in place, even if the formal certification will come in a second phase.
We document all these commitments in writing:
- Data Processing Agreement (DPA) — available on request
- Detailed Security Overview — for your IT and CISO teams, under NDA
- Complete subprocessor list — public at /subprocessors
And if you want to dig deeper, let’s talk directly: security@finareo.io.
Our principle
Trust isn’t declared, it’s proven. All the information above is visible and verifiable. No statement about the security of your money deserves to be taken on faith — and we prefer it that way.