Evidence submitted through the client API is processed on behalf of the customer, who remains the data controller. FinCompliance Ltd acts as processor.
Evidence is processed and stored in the United Kingdom unless a different region is configured on the account.
Evidence and control results are retained for seven years to meet regulatory expectations. Client telemetry is retained for 90 days.
Privacy enquiries should be raised through your named account contact.