Security and data handling

What we do today to protect your platform’s and your sellers’ tax information. We describe only controls already in the product; we hold no certifications (SOC 2, ISO 27001) and do not claim any.

Credentials and keys

• Stripe and Facturapi API keys are stored encrypted with AES-256-GCM and you can delete them at any time.
• CFDIs are stamped from your own Facturapi account: your CSD (seal certificate) does not transit our servers.
• User passwords are stored as salted PBKDF2-SHA256 hashes, never in plain text.

Application access

• Sessions use HttpOnly, Secure cookies; forms reject cross-origin requests.
• Failed sign-in attempts are rate-limited per email and per IP.
• SAT access (CFF art. 30-B / rule 2.9.21) is read-only, with a separate 8-hour session and a log of every query.
• The seller portal shows only that seller’s own data.

Integrity and retention

• Immutable daily ledger with a hash chain: a later change to a closed day is detectable.
• We keep transactions for five years (RMF rule 2.9.21; CFF art. 30). You can export everything as CSV when you cancel.
• Stripe payout adjustments (netting or reversal) only happen if you enable them; by default everything is a dry run.

Providers that process data

• Cloudflare: infrastructure (application and database).
• Stripe: subscription billing and, if you connect it, reading your Connect payments.
• Facturapi: stamping, only if you connect your key.
• SAT: only when the platform enables the access the law requires. We do not sell data.

Report a security issue

Email hello@acrogenesis.com or use the contact form. More detail in the privacy notice and the terms.