# Data protection

What SwissPay holds when you use the API.

## Data we hold

### About your account

* The legal entity associated with your SwissPay account.
* Authentication and team data (email addresses, hashed passwords, MFA state, sign-in history).
* Your API keys — stored encrypted; the plaintext key is shown only once at creation.

### About your customers

* Customer email, name, locale, phone, and (optionally) `billing_address`, `delivery_address`, `date_of_birth`.
* `metadata` you attach to a customer.
* The `external_id` you provide to map customers back to your own system.

### About your payments

* Per payment: amount, currency, status, your `reference`, processor reference, payment-method metadata (brand, last 4, expiry month/year), and any `metadata` you attached.
* Operational signals you pass on the request: `shopper_ip`, `browser_info`, and `risk_data` — forwarded to our risk engine.

### What we never store

* The full card number (PAN).
* The card security code (CVV / CVC).
* Any sensitive authentication data such as magnetic-stripe data, PIN, or raw 3-D Secure authentication values.

## Where the data lives

* **Region:** Microsoft Azure, Switzerland North.
* **Encryption at rest:** All databases and storage are encrypted at rest.
* **Encryption in transit:** Every connection in and out of SwissPay uses TLS 1.2 or higher.

## How long we keep it

* **Audit log:** indefinitely.
* **Payments and customers:** retained for as long as your account is active. Specific retention windows beyond that follow financial recordkeeping obligations.
* **API access logs:** rolling window for security investigation purposes.

## What you can request

Under GDPR / FADP and similar laws, you and your customers can request:

* A copy of personal data we hold.
* Correction of inaccurate data.
* Deletion of personal data where legally permitted (subject to financial recordkeeping obligations).

Requests go to <privacy@swisspay.ai>. We respond within statutory deadlines.

## Sub-processors

SwissPay uses sub-processors for hosting, payment processing, and operational tooling (transactional email, error monitoring). The current list is available on request from <privacy@swisspay.ai>. Each sub-processor is bound by a Data Processing Agreement.

## Data export

You can export the data we hold about your customers and payments through the API itself — `GET /api/v1/customers` and `GET /api/v1/payments` are paginated lists you can walk.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://support.swisspay.ai/security/data-protection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.