Security at
Settio

• Database: MongoDB Atlas, [ADD: MongoDB Atlas cluster region, e.g. AWS eu-north-1 Stockholm].
• Uploaded files: Cloudflare R2, Cloudflare's global storage (it may be outside the EU).
• Application: [ADD: hosting provider and region of app.settio.io].
• The full list of providers, with locations and transfer safeguards, is on our subprocessors page.

• Every connection uses HTTPS.
• The database and file storage providers encrypt data at rest.
• Personal identity numbers and integration credentials are encrypted again in our code (AES-256-GCM).
• Passwords are stored as bcrypt hashes. Sign-in codes, portal links, password reset and team invitation links, and API keys are stored only as hashes.
• Changing a password ends the other sessions.
• Secrets live in the hosting environment, never in the source code.

• Each workspace sees only its own data, and every request checks who is asking before it reads anything.
• Roles (Admin, Member, Viewer, and an agency’s clients) decide what each user may see and do.
• Employees reach only their own household’s case in the portal, with a one-time code by email.
• Wrong passwords are throttled, and the sign-in history is kept for 400 days.

Passports, national ID cards and residence permit cards in the platform and the portal are read on the person’s own device or on our servers, from the machine-readable zone, never by an AI service. No copy of a passport or ID card is kept, only the details read from it, and every time someone opens an identity document’s details it is logged.

• Every change is reviewed and runs automated tests, including tests for the findings of our own security review.
• Webhooks refuse private and internal addresses (protection against server-side request forgery).
• Public endpoints have rate limits.
• Text in uploaded documents is treated as data, never as instructions to the AI.

Each case keeps an activity record of who changed what. Each workspace has an audit log of team changes (400 days). Scheduled jobs record every run.

Closed cases are anonymised automatically after the period the workspace sets: files are deleted and personal fields wiped, except a permit copy that the destination’s law requires the employer to keep.

If a personal data breach affects a customer’s data, we tell the customer without undue delay and within 48 hours of becoming aware of it, so it can meet its own 72-hour deadline under Article 33 GDPR. Where we are the controller, we notify the Swedish Authority for Privacy Protection (IMY) within 72 hours when the law requires it, and the people affected when the risk is high.

Each provider that processes customer data has a written data processing agreement with us. We give customers 30 days’ notice before adding one; see the DPA.