Last reviewed: 2026-10-30
Data governance at PAI'D
This is the public edition of our data governance policy: what PAI'D stores, where it comes from, how long we keep it, and what you can ask us to do with it. It describes what our code does today. Where the code does not do something yet, we say so.
What we store
About merchants and their people
- Business details: legal name, jurisdiction, tax identifier, contact details, and the web address merchants give us for event notifications.
- Sign-in details: email address, a bcrypt hash of the password, the second-factor secret, and hashes of recovery codes.
- Beneficial owners and representatives, for onboarding: name, date of birth, email, phone, address, ownership share, and the last four digits of an ID number. Full identity numbers and identity documents are sent to Stripe for verification and are kept by Stripe.
About payments
- What Stripe reports back about each payment: amount, currency, status, timestamps, the card brand and last four digits, and any customer details the merchant sends with the payment, such as an email address.
- Card numbers never reach our servers. Card details are typed into Stripe's own payment fields and go straight to Stripe.
About bank accounts
- When a merchant links a payout bank account through Plaid, we keep an access token, encrypted, and the last four digits of the account.
Our own records
- An append-only audit log of security and payment events.
- Sanctions screening results for merchants and their beneficial owners.
Who else handles it
Stripe processes payments and verifies merchant identity. Plaid verifies payout bank accounts. Our hosting and network providers run the service. The full list, with what each one receives, is on our sub-processors page.
How it is protected
- All traffic uses HTTPS. In production, database connections must use TLS.
- Payment-provider credentials and bank-link tokens are encrypted by our application with AES-256-GCM before they are stored.
- Other fields, including tax identifiers and beneficial-owner details, are not encrypted by our application today. They are protected by access controls on the database.
- API keys and recovery codes are stored only as one-way hashes.
How long we keep it
These retention rules are enforced by code today:
| Data | Kept for |
|---|---|
| Signed-in sessions | 8 hours at most, and they end after 30 minutes without activity |
| Passkey sign-in challenge data | Short-lived, and cleared by a weekly clean-up |
| Expired keys and other expired short-lived records | Cleared by a weekly clean-up |
| A merchant account with an erasure request | Personal fields cleared after a 7-day grace period (see below) |
| Audit log and financial event log | Never deleted: append-only, and the database refuses deletion |
Everything else (merchant records, payment records, beneficial-owner details and screening results) has no automatic deletion schedule yet. It is kept while the account is open and after it closes. Setting deletion periods for these records, and enforcing them in code, is open work.
What you can ask us to do
- Export. A signed-in merchant can download an export of their account. Today it contains basic account fields only, not every record linked to the account.
- Erasure. A signed-in merchant can ask for their account to be erased. After a 7-day grace period, the business name is replaced with a placeholder; the tax identifier, webhook settings and API key are removed; and the account is closed. Payment records and the audit log stay, because the log cannot be changed and payment records may be needed for disputes and tax.
- Not yet covered by erasure: the account's contact email, the sign-in record (email address), customer records and beneficial-owner records linked to the account. Automatic erasure does not reach these yet.
If you are a merchant's customer, a beneficial owner, or anyone else whose data we may hold, write to us and we will tell you what we hold about you.
Not in place yet
- Deletion periods for financial, onboarding and screening records.
- An export and erasure that cover every record linked to an account.
- Encryption by our application of personal fields beyond credentials and bank-link tokens.
Privacy questions and data requests: privacy@trustfabric.ai