How we keep your affairs private.
Alfred holds sensitive things: tax records, contracts, ID documents. This page explains how we protect them, in plain terms.
What we keep, and for how long
| What | Where | Who can read it | How long | How to delete |
|---|---|---|---|---|
| Account email and name | Our database, on servers in the EU. Stripe holds them too if you pay through Alfred. | Alfred. The professional on your matter sees your name. Cloudflare delivers our emails to you. | While your account is open. An account nobody ever signs in to, with nothing stored in it, is deleted after 30 days. | Write to hello@alfredproctor.com and we close your account within 30 days. This is done by hand for now. |
| Documents, letters and messages on a matter | Our servers in the EU, encrypted with the matter's own key. A letter waits in our mail service, run by Cloudflare, until it is filed on the matter. | You, the professional engaged on the matter, and an AI assistant either of you connects. Alfred does not read letters with AI today. If we turn this on, a letter's text will go to OpenRouter, our model provider, which may process it outside the EU under Standard Contractual Clauses, and you will be able to turn it off on your details page. | Until you delete the matter. | Delete the matter once it is finished and no money on it is still moving. It goes from Alfred at once and from our backups within 14 days. |
| The description you give when you open a matter | Our servers in the EU, encrypted with the matter's own key. | You. If you ask Alfred to draft the matter from it, the text goes to OpenRouter, and we require that nothing is kept. | Until you delete the matter. | Delete the matter, and the description goes with it. |
| Logged work and time | Our database, on servers in the EU. Unlike documents, it is not encrypted with the matter's key. | You and the professional engaged on the matter. | The notes, until the matter is deleted. The minutes and the rate are kept with the payment records. | Delete the matter. The notes and descriptions are erased; the minutes and the rate stay. |
| Payment records | Our database, on servers in the EU, and Stripe, which processes payments and holds card details. | You, the professional you paid, Alfred and Stripe. Alfred never sees your card number. | For the period Portuguese tax law requires, currently ten years. | They cannot be deleted while that period runs, even when the matter is deleted. Stripe keeps its own records. |
| Sign-in links and sessions | Our database, on servers in the EU. | Alfred keeps only a one-way fingerprint of each, which cannot be used to sign in. While you are signed in, it also notes which browser you use. | A link works once, for 15 minutes, and is deleted a day after it is sent. A session's record is deleted 30 days after it ends. | Nothing to do: they are deleted on their own. Signing out ends a session at once. |
| Mail to Alfred's own addresses, such as hello@ | Our mail service, run by Cloudflare. | Alfred's staff. | 90 days. Cloudflare can restore what is deleted there for 30 days more. | It is deleted on its own after 90 days. You can ask us to delete it sooner. |
| Identity, registration and insurance documents a professional sends | Our servers in the EU, encrypted. | The Alfred staff who check applications. | If we turn the application down, 30 days after the decision. If they were never sent with an application, 7 days. Otherwise there is no end date yet. | Write to hello@alfredproctor.com. We act within one month. |
| Backups | Copies of our database and stored files. | Only the people who run Alfred. Files in them stay encrypted. | Up to 14 days. | Nothing to do. Whatever you delete leaves the backups as they expire, within 14 days. |
How we protect it
Each matter has its own key
Each matter has its own encryption key. Its documents, letters and messages are encrypted with that key (AES-256-GCM) before they are stored. The matter's key is itself encrypted with a master key kept apart from the data, and it cannot open any other matter.
Deleting a finished matter
When a matter is finished you can delete it. It is deleted from Alfred straight away: its documents, letters and messages, its encryption key, and the words written on it, such as its title and the notes on the work. It is gone from our backups within 14 days, as they expire. After that we can't get it back, and neither can anyone else. A bare record that the matter existed remains, with none of its contents.
Files are checked when opened
Each document gets a SHA-256 fingerprint when it is uploaded. We check it every time the document is opened, and if a single byte has changed, you get an error instead of the file. Each encrypted file is also tied to its own matter, so it cannot be moved to another one.
No passwords
There are no passwords in Alfred. You sign in with a link we email you. Each link works once and expires after 15 minutes. Your session is kept in a secure cookie, and signing out ends it.
It lives in Europe
Your data is hosted in the EU. Documents and letters are stored encrypted, and everything is encrypted in transit. Every letter that arrives is checked against SPF, DKIM and DMARC, and each one shows whether its sender was verified. Alfred does not read letters with AI today. If we turn this on, a letter's text will go to OpenRouter, our model provider, which may process it outside the EU under Standard Contractual Clauses, and you will be able to turn it off on your details page.
You pay what you agreed
A one-off job is paid by card up front. The money is released to the professional when you approve the work. A monthly plan is billed each month at the price you agreed. Payments run through Stripe, and we never see your card details.
You choose what to keep here
You don't have to keep documents or post in Alfred. Whatever you do keep here, you can download in full, and you can delete a matter once it is finished.
If you find a security problem or want more detail on our setup, write to security@alfredproctor.com.