1. Introduction
SFI Solution is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our financial reconciliation platform at sfisolution.com.
2. Information We Collect
Personal Information
- Name and email address when you create an account
- Billing information and payment details processed securely through Stripe
- Company name and business details you provide
Financial Data
- Bank statements and transaction data you upload for reconciliation
- Ledger data from connected accounting software (Xero, QuickBooks)
- Payment data from connected payment processors (Plaid, Stripe)
Usage Data
- Log data including IP address, browser type, and access times
- Pages visited and features used within the platform
- Reconciliation history and results
3. How We Use Your Information
- To provide and maintain our reconciliation service
- To process your transactions and manage your subscription
- To communicate with you about your account, updates, and support
- To improve our platform and develop new features
- To comply with legal obligations and enforce our terms
4. Data Security
We implement industry-standard security measures to protect your data, including:
- 256-bit SSL/TLS encryption for all data in transit
- Fernet encryption for stored access tokens and sensitive credentials
- Secure cloud infrastructure hosted on AWS (eu-west-1, United Kingdom / Ireland region)
- Per-tenant data isolation so one organisation cannot access another's data
- Role-based access control (RBAC) limiting staff access to what their role needs
- Regular security audits, vulnerability assessments and penetration testing
To report a security concern or a suspected incident, email security@sfisolution.com. We investigate reports promptly and, where a personal-data breach occurs, notify the ICO and any affected authorities within 72 hours.
HMRC Making Tax Digital (VAT)
When you connect your organisation to HMRC for Making Tax Digital, you authenticate directly with HMRC using OAuth 2.0. We never see or store your HMRC (Government Gateway) sign-in details — we only store the encrypted access/refresh tokens HMRC issues, so we can retrieve your VAT obligations and submit VAT returns on your behalf.
- Your 9-box VAT figures are calculated from your own ledger and submitted only when you choose to file.
- As required by HMRC, we send fraud-prevention header data with each request to help protect your account.
- You can disconnect from HMRC at any time, which removes the stored tokens.
5. Data Retention
We retain your personal information for as long as your account is active or as needed to provide you services. Financial data uploaded for reconciliation is stored for the duration of your subscription. You may request deletion of your data at any time by contacting us.
6. Third-Party Services
We use the following third-party services to operate our platform:
- Stripe — Payment processing and subscription management
- Plaid — Secure bank account connections
- Xero & QuickBooks — Accounting software integrations
- AWS — Cloud hosting and infrastructure
Each third-party service has its own privacy policy governing the use of your information.
7. Your Rights
Our lawful basis for processing your data is the performance of our contract with you (providing the service) and our legitimate interests in operating and securing it. Under UK GDPR you have the right to:
- Access and receive a copy of your personal data
- Rectify any inaccurate personal information
- Request deletion of your personal data
- Object to or restrict processing of your data
- Data portability — receive your data in a structured format
- Withdraw consent at any time where processing is based on consent
8. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at:
Email: support@sfisolution.com