SOC 2 Type II. AES-256 encryption. US-only hosting.

Only what we need to file your business: business name, member/officer names and addresses, EIN application data, banking details for billing. We do not collect Social Security numbers from US customers for formation purposes (only for the EIN if you choose to authorize us to file it). Foreign founders provide passport info only when required by state regulators.

Filing specialists assigned to your account, customer support agents you message, and our security team for audit purposes. Access is role-based and logged. No employee can browse customer records outside their assignment. Audit trail available to enterprise customers.

US-based AWS regions (us-east-1 primary, us-west-2 disaster recovery). All processing happens in the US. Sub-processor list maintained below.

Active customers: indefinitely while account is active. Cancelled accounts: 7 years for tax + audit retention, then permanent deletion. Formation documents are yours forever; export anytime via the dashboard.

Within 72 hours of confirmed incident affecting customer data: direct email to every affected customer with what happened, what data was involved, and steps taken. Public postmortem on /status page. Coordination with law enforcement and regulators per applicable law.

Yes. Email privacy@file.business and we will delete within 30 days, except where retention is legally required (tax records, formation document retention obligations). We confirm deletion in writing.