Security
Last updated 30 October 2026
Your clients send you tax returns, bank statements and IDs through Elargi. This page says exactly how we protect them, and what we don’t do yet. Questions or a security problem to report: hello@elargi.com.
Where your data lives
- The app and the database run in Frankfurt, Germany.
- Uploaded files are stored with Backblaze B2 in its EU region, in private storage that is never public.
- The database is backed up every night to a separate private bucket. Backups are kept for 30 days, then deleted.
Encryption
- Every page, upload, download and email link uses HTTPS (TLS).
- The app’s connection to the database is encrypted, and the database’s certificate is checked.
- Every uploaded file and every backup is encrypted at rest (AES-256).
- Passwords are stored only as a salted hash. Nobody at Elargi can read them.
Who can see your clients’ files
- Only people signed in to your firm’s account: you, and team members you invite (you can remove them at any time).
- Clients can upload, but never download. Not even their own files. Someone who gets hold of a client link can see file names and typed answers, but can’t open the files.
- Client links are long random codes (192 bits) that can’t be guessed. A link stops accepting uploads once you close the request.
- Your downloads use signed links that expire after 2 minutes, served from the storage domain rather than ours.
- Every firm’s data is kept separate. Our automated tests check that one firm can’t open another firm’s requests, files or ZIPs.
- We don’t sell data, use it for advertising, or train AI models on it.
Your account
- Email addresses must be confirmed before an account can be used.
- Two-factor sign-in with an authenticator app, plus backup codes, under Settings. We recommend turning it on.
- Sign-in attempts are rate-limited, and you’re signed out after 30 days without using Elargi.
Keeping and deleting data
- Deleting a request deletes its files straight away.
- You can have closed requests deleted automatically after 30, 90, 180 or 365 days (Settings → Auto-delete closed requests).
- Deleting your account deletes every file and record at once. Copies in backups disappear within 30 days.
- You can export everything we hold about your firm as JSON, and download each request’s files as one ZIP.
Who processes data for us
These providers process data only to run their part of Elargi. We’ll update this list before adding a new one.
| Provider | What it does | Where |
|---|---|---|
| Render | Runs the Elargi app | Frankfurt, Germany |
| Neon | Database (accounts, requests, client names and emails, answers) | Frankfurt, Germany |
| Backblaze B2 | Uploaded files and nightly database backups | EU region |
| Cloudflare | Domain name and network in front of the app (all traffic passes through it, encrypted) | Global network |
| Resend | Sends request, reminder and account emails | USA |
| GitHub | Runs the nightly backup job that copies the database to the backup bucket | USA |
| Paddle | Billing for firms on Solo or Firm (never sees client documents) | United Kingdom |
If you connect Google Drive, Dropbox or OneDrive, Elargi copies new uploads to that account. That provider is your choice and works under your own agreement with it.
What we don’t have yet
- No SOC 2 or ISO 27001 certification. Elargi is a small, independent business.
- Uploads aren’t scanned for viruses. Treat files from clients as you would an email attachment.
Data protection agreement
For your clients’ data you are the controller and Elargi is your processor. Our data processing agreement covers this and applies automatically when you use Elargi. See also our privacy policy.