Security & Compliance

At Stackdeck we take privacy seriously and for that reason we have selected DigitalOcean to securely store data.

DigitalOcean plays a crucial role in our business and we trust it with our most sensitive data, which is why we made a very conscious choice when selecting this provider.

Our managed database clusters are encrypted at rest with LUKS (Linux Unified Key Setup) and in transit with SSL.

Service instances and the underlying VMs use full volume encryption using LUKS with a randomly generated ephemeral key per each instance and each volume. The key is never re-used and will be trashed at the destruction of the instance, so there’s a natural key rotation with roll-forward upgrades. We use the LUKS default mode aes-xts-plain64:sha256 with a 512-bit key.

Backups are encrypted with a randomly generated key per file. These keys are in turn encrypted with RSA key-encryption key-pair and stored in the header section of each backup segment. The file encryption is performed with AES-256 in CTR mode with HMAC-SHA256 for integrity protection. The RSA key pair is randomly generated for each service. The key lengths are 256-bit for block encryption, 512-bit for integrity protection, and 3072-bits for the RSA key.

Data Processed: All customer data (such as, but not limited to employee information (including names and email addresses), collected bill information, subscription information and more).

Data Location: Amsterdam

At Stackdeck, we employ Apideck to offer a unified data-proxy API that seamlessly integrates accounting and HRIS (Human Resources Information System) services. This integration facilitates efficient data management and connectivity between our core business functions, enhancing operational efficiency and data coherence.

We prioritize data security, implementing advanced encryption and access controls to protect the information managed through Apideck. Stackdeck is dedicated to upholding transparency, adhering to privacy regulations, and ensuring robust contractual protections in our use of Apideck.

Data Processed: Integration data for accounting and HRIS services, Customer details (including name and email).

Data Location: Belgium

‍

At Stackdeck, we utilize Postmark for the reliable delivery of transactional emails directly to our customers' employees via our platform. This service ensures timely and secure communication, essential for operational efficiency and customer satisfaction.

We commit to the highest standards of data security, employing advanced encryption and access controls to safeguard email content. Stackdeck ensures transparency, compliance with privacy laws, and stringent contractual safeguards with our use of Postmark.

Data Processed: Transactional email content and recipient details.

Data Location: United States

At Stackdeck, we leverage MongoDB for the secure storage of activity logs, ensuring that operational data is efficiently captured and stored. This use of MongoDB facilitates comprehensive logging of system activities, aiding in monitoring, analysis, and auditing processes.

We prioritize data security, utilizing advanced encryption and stringent access controls to protect the stored logs. Stackdeck is committed to transparency, adhering to privacy laws, and maintaining robust contractual protections with our use of MongoDB.

Data Processed: Activity logs detailing system operations.

Data Location: Frankfurt.

‍

At Stackdeck, we use ChatGPT to streamline transaction processing, focusing on the distillation of product and supplier information. By analyzing merchant names and transaction descriptions, we enhance the accuracy of transaction identification without processing transaction amounts, unless specified in the description.

We ensure data security through robust encryption and strict access controls, maintaining transparency and compliance with privacy laws. Stackdeck's use of ChatGPT includes stringent data protection measures.

We have filed a "Do not train on my content request" with OpenAI to not use our data as training data. OpenAI confirmed our request and confirmed that it does not train their model(s) on our data.

Data Processed: Merchant names and transaction descriptions for the purpose of transaction identification and categorisation. Customer names (your business name) is never shared with OpenAI.

Data Location: Northern America