Legal · Data

GDPR

Last updated: October 2026

AspisFile is built in the EU and designed around the principles of the General Data Protection Regulation. This page summarises how we handle your data; for the full legal text, see our privacy notice and terms.

What we never see

We never see your biometric data or your passkey private keys. We do not read, index or analyse the contents of your documents, and we keep no readable copy.

How your documents are protected

Documents are encrypted on the sender's device before they reach us. The key that decrypts a document is split in two: one half is wrapped by a hardware-backed key service, the other by the recipient's access token. The two halves come together only in memory, only to render a page for an authenticated, device-bound recipient, and are discarded immediately afterwards. Every render is recorded in the audit trail and anchored, and production access is limited to named staff using hardware-backed authentication.

The next step in that design moves the render inside a hardware enclave, and it is delivered with an enterprise deployment. Our viewer security page sets out the technical detail, including where the boundary sits today.

What we do hold

Account email addresses, file metadata (names, sizes, type, timestamps), recipient email addresses, access events (when a file was opened, from where), and the technical identifiers used by our coherence engine to detect suspicious access patterns.

Where it lives

Our primary database is hosted in Zurich, Switzerland — a country the European Commission has formally recognised as providing an adequate level of data protection. Encrypted file storage and key management are in the European Union (AWS eu‑north‑1, Stockholm), as is our application runtime (Frankfurt) and our backup email path (Ireland). For sub-processors outside the EU and Switzerland we require the European Commission's Standard Contractual Clauses or an equivalent transfer safeguard. The current list is available on request at hello@aspisfile.com.

Your rights

Under GDPR you have the right to access, rectify, port, restrict, or erase your personal data, and to object to certain processing. You may also lodge a complaint with your local supervisory authority. Send requests to hello@aspisfile.com; we respond within 30 days.

Data Protection Officer

For privacy enquiries, write to hello@aspisfile.com.