How Exclia handles your data

How the system is put together

• Four parts make up the product: this public site, the application you sign in to, an API that serves it, and a background worker that runs screenings, sends notifications, and builds reports. Behind them sits one Postgres database holding your roster, your screening history, and your audit log.

• Screening runs inside Exclia. Your roster is not sent to a list publisher, to an outside matching service, or to any AI service — there is no code path that does so, and no such provider appears anywhere in the product’s dependencies.

• The background worker takes its jobs from Redis, which holds job descriptions — identifiers, and for an email job the recipient address — together with the rate-limit counters. Your roster is not stored there.

• A finished report is written once to object storage under a key nothing rewrites, in a bucket with versioning on. A correction is a new report rather than an edit of the one an auditor already has.

What Exclia does not store

• Exclia stores no Social Security numbers. Not as an optional field, not in a note, not anywhere: there is no column for one in the database and no parameter for one in the API.

• No personal tax identifiers of any kind, either. The only tax identifier Exclia holds is an organization’s EIN, and only if you choose to enter one — a business identifier rather than a person’s.

• Confirming a potential match needs a date of birth or a Social Security number, so that step happens on the OIG’s own verification tool, where those identifiers already are. Exclia records the outcome you reached and the reasoning you wrote — never the identifiers you used to reach it. The federal list download omits them by design, and this design follows that rather than working around it.

• Nothing in Exclia states an automated verdict about a person. The strongest claim any screening produces is “potential match — verification required”, and that rule is enforced in one shared formatting module every surface renders through, not in each screen’s copy.

Encryption

• Every request Exclia makes to a provider — identity, payments, email, object storage, bot protection — goes over HTTPS.

• Report PDFs are encrypted at rest by the storage provider, in a bucket that is not publicly readable. Every download is signed on the server and served through an authenticated path, so a report URL is not a link anyone can pass around.

• API keys are not stored. The database holds a SHA-256 hash, so a key shown once at creation cannot be read back out of us by anyone — a lost key is rotated, never recovered.

• The signing secrets behind outbound webhooks are encrypted at rest with AES-256-GCM, under key material held in the deployment’s configuration rather than in the database beside them.

Where the data is, and who we are

• Exclia is operated from Spain by one person. That is who processes your data — there is no other staff, and no contractor with access to it. The providers listed further down are the only other parties involved, and the table says what each one receives.

• Report PDFs — which name the people on your roster — are stored in North America. For an operator established in Spain that is an international transfer, so it is named here rather than left implicit.

Who can reach your data

• Every endpoint checks the caller’s role on the server, and every query is scoped to one organization. Nothing is held closed by a hidden button.

• Sign-in and sessions are handled by Clerk. Exclia never receives or stores a password, and multi-factor is Clerk’s own setting rather than something reimplemented here.

• Support access to your organization runs as an impersonation session that expires after 60 minutes, and every action taken inside one is written to your own audit log, attributed to the operator rather than to your user. You can read what was done on your data, in the same place you read everything else.

• The audit log is append-only. Corrections are new entries, and no part of the product edits or removes one — including the retention job, which holds a port that can only append.

• The free checker and the API are rate-limited through one shared counter, so a published ceiling holds however many instances are running, and the checker sits behind a bot check that refuses when it cannot reach its verifier.

How long we keep it

• While your subscription is active, your roster, screening history, reports, and audit log are kept.

• If you cancel, you keep full export access for 90 days. When that window closes, the roster and the screening history are deleted by a scheduled job that computes the date from your cancellation, records what it removed and what it kept, and cannot run twice on the same organization.

• Two things outlive that window on purpose: the audit reports your organization generated, and the resolution records behind them. That is the evidentiary trail — the proof that you screened a given person on a given date against a given list version. Removing it would take away the evidence the product exists to produce, for periods you have already paid for and may be asked about years later.

• An erasure request leaves a tombstone rather than a hole. The person’s identifying details are cleared from their record; the record itself stays as a marker, so the screening history that points at it still says a screening happened without saying who it was about. A tombstoned record stops being screened and stops counting against your plan.

Durability and availability

• Report storage keeps every version of an object, so an overwrite cannot take away a copy an auditor has already been given.

Certifications we do not hold

• Exclia holds no SOC 2 report, no ISO 27001 certificate, and no HIPAA attestation, and this page claims none. Nor is an audit “under way” — when it is, this page says so with a date on it. The posture is deliberate: document the real practices now, and undertake a certification at the point a customer requires one in writing.

• No third-party penetration test has been performed. If that matters to your review, say so — it is the kind of thing a customer asking in writing moves up the list.

Who else touches your data

These are the third parties that process something on Exclia’s behalf, and what each one actually receives. A provider that is added to the product is added to this list in the same change.