Security

1. Why this page exists

You are being asked to put your clients' bank statements, payslips and tax documents into voan. That deserves a straight answer about how they are protected, and an equally straight answer about what is not in place yet.

Everything below describes how voan actually works today. Where we do not have something, section 9 says so.

2. Your clients' documents

Uploaded files go into a private storage bucket. They are encrypted at rest and there is no public URL for any file — a document cannot be reached by guessing an address.

When you open a document from your dashboard, voan checks that it belongs to your firm and then issues a signed link that expires after one hour. The link stops working when it expires.

3. Separation between firms

Every table that holds firm or client data is protected by row-level security in Postgres, enforced by the database itself rather than by application code. A query issued while signed in as one firm cannot return another firm's rows even if the application asks for them.

This is the control we care most about, so it is tested directly with a second account rather than assumed.

4. How your client sends a document

Each client gets one private link, and they never create an account or a password — a portal login is the single biggest reason clients stop responding. They can also simply reply to a reminder with the files attached, the way they would reply to any other email.

That link is the client's, not the document's: it covers every request that client currently owes you, so they can send everything in one go without hunting for a second link. It never exposes anything belonging to a different client.

The same token is also the address their email reply arrives at, so one credential covers both routes. The trade-off is that the link is the credential — anyone holding it can send documents in against that client, so treat it as confidential. If a link is circulated by mistake, email us and we will issue that client a new one, which stops the old link and the old address working.

5. In transit

All traffic to voan — your dashboard, your clients' upload pages, and our APIs — runs over TLS. There is no unencrypted path into the service.

6. Who can see your data

Administrative access is restricted to what is needed to operate and support the Service, and is used for that purpose — not to read your clients' documents.

We do not open uploaded documents, we do not sell data, and we do not use your clients' documents to train AI models. voan's document checks are deterministic — checksum and pattern validation such as IBAN and VAT number verification — not a model reading your files.

7. The infrastructure we build on

voan runs on a small number of established providers, each contracted as a sub-processor under our Data Processing Agreement:

• • Supabase — database, authentication and encrypted document storage. EU region.
• • Vercel — application hosting. Functions run in Dublin (eu-west-1).
• • Resend — reminder and notification email. Ireland (eu-west-1).
• • Cloudflare — receives the email your clients reply to and hands it straight to us. Cloudflare's mail routing is a global network, so this is the one hop that is not pinned to an EU region.
• • Paddle — payments. Paddle is the merchant of record and handles card details; we never see or store a card number.

Everything we store and everything we send runs in an EU region — the database, the documents, the application that receives uploads, and the reminder email that goes out. That is a deliberate choice, not a default: Vercel's default region is the United States and we moved it.

The first exception is inbound email. When your client replies with a file attached, that message reaches us through Cloudflare's mail routing, which is a global network rather than an EU-pinned one. Cloudflare hands the message to our application in Dublin, and that is where the attachment is stored — we do not keep a copy anywhere else. We would rather name that hop than let you assume the whole path is EU-only.

The second is one you switch on yourself. If you connect your own Google account so that reminders leave from your address rather than ours, those messages are handed to Google and travel on Google's network under your agreement with Google, not ours. voan asks Google for a single permission — send only. It carries no ability to read, search, download or delete anything in your mailbox, and we never see your inbox, your sent mail or your contacts. The Privacy Policy sets that out in full.

8. Backups

The database is backed up by our infrastructure provider on a continuous basis, so a failure means restoring to a recent point in time rather than losing your data. Documents sit in replicated object storage.

Backups are not a substitute for your own records. If your firm is required to retain client documents independently, keep doing that.

9. What we do not have — stated plainly

Some vendors in this market present their hosting provider's certifications as their own. We are not going to do that, so here is the honest position:

• • voan does not hold SOC 2 or ISO 27001 certification. Our providers hold their own certifications; those are theirs, not ours, and we do not claim them.
• • There is no contractual uptime SLA or service credit scheme. (No vendor we compared in this market publishes one either — we are telling you rather than letting you assume.)
• • We have not yet completed an independent third-party penetration test.

If your firm's procurement process requires a certified supplier, voan is not the right fit today, and we would rather you know that now than three months in.

10. If something goes wrong

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any event within 72 hours, with enough detail for you to meet your own reporting duty to the Data Protection Commission. That commitment is written into our Data Processing Agreement, not just this page.

11. Reporting a vulnerability

If you find a security problem in voan, email info@voan.ai. We will confirm receipt, keep you updated while we fix it, and we will not pursue anyone who reports a genuine issue in good faith.