Who we are
Svrnclerk is a bank-transaction ingest relay operated in the European
Union. For privacy matters contact privacy@svrnclerk.com.
What we process
-
Account data: your email address and account credentials for this service.
-
Bank connection metadata: the bank (ASPSP) name and country, consent validity, and an opaque account identifier.
-
Delegated access: the session granted by your bank via the licensed AISP, stored encrypted (see below).
-
Transaction data: retrieved from the AISP solely to be normalized and delivered to you, then discarded. We do not store transactions.
-
Delivery data: the destination email address and the public encryption key you provide.
Your bank and the AISP see your data
Under PSD2, your bank and the licensed Account Information Service
Provider (AISP) you connect through necessarily process your account
data; they act as independent controllers for that processing. Svrnclerk
is not a party to your plaintext beyond the transient normalization step.
How we protect it
-
Delegated access is encrypted with a key unique to your account (AES-256-GCM); the key-encryption key is held in our hosting environment's secret store.
-
Transaction payloads are encrypted to your
public key before delivery. We hold no decryption key for them.
- We keep no transaction history, no amounts and no counterparties at rest.
Processors we use
-
Hosting: Fly.io (EU region, Frankfurt) — application and database.
-
AISP: Enable Banking (and, where applicable, other licensed AISPs) — bank connectivity.
-
Email delivery: Resend — sending the encrypted envelope to your configured address.
Retention
Connection metadata and your delivery settings are kept while your
account is active. Delegated access is deleted when the consent expires
or you disconnect. Transaction data is discarded after delivery.
Your rights
You may access, rectify, export or erase your data, withdraw consent, or
object to processing. Erasure is implemented by destroying your account's
encryption key, which renders stored delegated access permanently
unreadable. You may also lodge a complaint with your local supervisory
authority. Requests: privacy@svrnclerk.com.
Legal basis
We process data to perform our contract with you (Art. 6(1)(b) GDPR) and,
for security and abuse prevention, on the basis of our legitimate
interests (Art. 6(1)(f) GDPR).