Your accounting data is securely hosted in Europe
Our primary data infrastructure is hosted in the European Union. Data is encrypted at rest and in transit, with strict access controls and comprehensive logging. Where specific features rely on authorized third-party service providers, limited data may be processed outside the European Union subject to appropriate safeguards and our Privacy Policy.
- SendingEnd-to-end TLS 1.3, no exceptions.01
- StorageAES-256, keys managed in Europe.02
- ProcessingIsolated per company, never pooled.03
- AccessSSO and two-factor, every read logged.04
Guarantees backed by the AWS infrastructure
The Company Land is hosted on Amazon Web Services, in the Paris region. We inherit the hosting provider’s certifications for the infrastructure; GDPR compliance and access control remain our responsibility.
- GDPRAppointed data protection officer, processing register kept up to date, and a standard data processing agreement.DPA available
- S3 AES-256 encryptionEvery document is encrypted server-side by Amazon S3 with AES-256 as soon as it is uploaded, and only decrypted when read by an authorised user.Encryption at rest
- AWS SOC reportsThe AWS services we rely on are covered by SOC 1, 2 and 3 reports, renewed every year by an independent auditor and available through AWS Artifact.Renewed every year
- AWS Paris regionData stored and backed up in the eu-west-3 region of Amazon Web Services, in France. No replication outside the European Union.Hosted in the EU
Every company is isolated, key included
Your company's data lives in its own logical space, with its own encryption key. A breach does not spread from one file to another.
- Keys managed by hardware security module, with automatic rotation
- No direct database access by our teams, even in production
- Annual external penetration test, summary provided on request
- Administrator accountEnterprise SSO, two-factor mandatoryActive
- Partner practiceRead access, expires automatically at the end of the engagementActive
- Service tokenRestricted scope, scheduled rotationActive
Every document view is logged and kept for the full statutory period.
What we guarantee, line by line
The same table we hand to our clients' IT departments.
- Supporting documents
- Location
- European Union
- Encryption
- AES-256 at rest
- Retention
- Statutory retention period
- Ledger entries
- Location
- European Union
- Encryption
- AES-256 at rest
- Retention
- Statutory retention period
- Banking credentials
- Location
- Never stored
- Encryption
- Mandate held by the authorised provider
- Retention
- —
- Access logs
- Location
- European Union
- Encryption
- AES-256 and timestamping
- Retention
- Statutory retention period
- Backups
- Location
- European Union
- Encryption
- AES-256, offline copy
- Retention
- Rolling window
| Data | Location | Encryption | Retention |
|---|---|---|---|
| Supporting documents | European Union | AES-256 at rest | Statutory retention period |
| Ledger entries | European Union | AES-256 at rest | Statutory retention period |
| Banking credentials | Never stored | Mandate held by the authorised provider | — |
| Access logs | European Union | AES-256 and timestamping | Statutory retention period |
| Backups | European Union | AES-256, offline copy | Rolling window |
Security across our infrastructure
We carefully select service providers that support The Company Land's infrastructure and features, including cloud hosting, authentication, open banking and artificial intelligence services.
We limit the data shared with these providers to what is necessary for the relevant functionality and require appropriate security and data protection safeguards.
For details about how personal data is processed and shared, see our Privacy Policy.
The questions your IT teams ask
Every document, in one place
Hosting provider certifications, security policy, penetration test results, list of subprocessors: the security team sends them on request.