How Selvia protects your data

• Access to data in the Selvia Accounting database is controlled by row-level security rules on every table, so a signed-in customer can reach only the records their access allows.
• Selvia staff use the back office with individual accounts and role-based permissions. Actions such as approving documents or finalising a VAT period require the matching permission.
• The Selvia POS till checks staff, manager and owner roles on the server, not just in the menu.

• Changes to invoices, expenses, bank reconciliation and VAT periods are recorded in activity trails that are only ever added to.
• Posted ledger entries cannot be changed, and a filed VAT period is kept as a fixed record of what was filed.
• Refunds in Selvia POS keep the original sale; nothing is overwritten.

• selvia.fi and the app’s services are used over encrypted HTTPS connections, and browsers are instructed to use HTTPS only.
• The website sends security headers that prevent it from being embedded in other sites and limit what browsers may do.
• Personal identity numbers are encrypted before they are stored.
• Passwords are handled by our authentication service; Selvia does not store them in readable form.

The Selvia Accounting database is hosted in the EU (Ireland) and the Selvia POS database in the EU (Sweden). Some service providers — for example for hosting, email, text recognition and push notifications — are based in or may process data outside the EU. The Subprocessor List names them, and the Privacy Policy explains how such transfers are protected.

• In the Selvia app you can turn on app lock, which uses your device’s fingerprint, face or passcode check. The check happens on your device.
• Deleting an account in the app requires you to confirm your password again.
• Account deletion requests made on the website never delete anything by themselves: Selvia first verifies that the request comes from the account holder. The requester’s IP address is stored only as a keyed hash.
• The website’s contact and deletion forms limit repeated submissions to reduce misuse.

• Use a strong password that you don’t use elsewhere, and don’t share it.
• Turn on app lock on the phone you use for Selvia.
• Tell us at once at support@selvia.fi if you think someone else has used your account.
• Never send passwords or full bank card numbers by email or in support messages.

If a personal data breach occurs, Selvia handles it as the GDPR requires. For data where Selvia is the controller — such as your account and profile — that can include notifying the Office of the Data Protection Ombudsman, where the breach is likely to risk people’s rights and freedoms, and telling the people affected, where the risk is high. Not every incident reaches either threshold; the GDPR sets them deliberately, and Selvia follows them rather than a fixed promise to report everything.

For personal data Selvia processes as a processor on a business customer's behalf — see the Data Processing Agreement — Selvia notifies the customer without undue delay, and it is then the customer's responsibility as controller to assess the risk and notify the authority or the people affected where the law requires it.

If you believe you have found a security issue in a Selvia service, email support@selvia.fi with “Security” in the subject line. Please don’t test or exploit the issue further, and don’t access other people’s data.

No online service can guarantee absolute security. We describe what we do, and we keep improving it.