How We Process and Protect Your Data
Learn how AML PROOF processes, stores, and protects your data, our trusted sub‑processors, international transfer safeguards, and the GDPR/AMLR controls we apply across the platform.
Data Processing Overview
What Data We Process
- Client identification data (the AML Act)
- Records of trades and ongoing monitoring of the business relationship (the AML Act)
- Risk assessment (the AML Act)
- Suspicious transaction reports and audit trails (the AML Act)
- User account and authentication information
Processing Purposes
- Fulfilling obligations under the AML Act and the international sanctions legislation
- Risk assessment and fraud prevention
- Client identification and control, enhanced client identification and control
- Reporting suspicious transactions to the FIU (Financial Intelligence Unit)
- Service provision and platform functionality
Legal Basis for Processing
Legal Obligation
Processing required to comply with AML/CFT laws and regulatory requirements across jurisdictions.
Includes: customer and company identification and verification, AML record keeping, sanctions screening, suspicious transaction reports to the FIU.
Legitimate Interest
Processing necessary for fraud prevention, security, and providing effective compliance services.
Includes: security monitoring, fraud prevention, pseudonymized usage analytics, commercial communications to existing clients.
Contractual Necessity
Processing required to perform our contractual obligations and deliver agreed services.
Includes: account operation, report generation, platform access.
Trusted Sub-processors
We work with carefully selected sub-processors to deliver our services. All sub-processors are bound by strict data protection agreements and undergo regular security assessments.
| Sub-processor | Service | Location | Data Processed |
|---|---|---|---|
| Neon | Database Services | EU (AWS eu-central-1, Frankfurt) | User data, compliance records |
| Vercel Inc. | Hosting, Storage & Analytics | EU (fra1, Frankfurt) | Application data, logs, files |
| Amazon Web Services EMEA SARL, Luxembourg | Encrypted file backups | EU (Sweden) | files uploaded to the platform |
| Stripe Technology Europe, Limited (Ireland) | Payment processing and invoicing | EU (Ireland); transfer to the US (SCCs) | Payment information |
| Fio banka | Remote micro-transfer (identity verification) | EU, Czech Republic | Bank account for 1 CZK / 0.10 EUR micro-transfer; transaction data for matching and refunds |
| Resend | Email Services | EU, Ireland (eu-west-1) | Email addresses, communications |
| OAuth Authentication | US, EU | Authentication data, profile information | |
| Microsoft | Sign-in with a Microsoft account (OAuth) | US, EU (SCCs) | Authentication and profile data |
| Sign-in with a LinkedIn account (OAuth), where enabled | US, EU (SCCs) | Authentication and profile data | |
| OpenSanctions | PEP and Sanctions Screening | EU, Berlin (Germany) | Names, dates of birth, countries for screening |
| European Commission / EU Council | EU Consolidated Sanctions List (data source) | EU | We download the list; screening is performed locally; no client data is sent |
| MZV ČR (Ministerstvo zahraničních věcí) | Czech National Sanctions List (data source) | Czech Republic | We use the list for screening; data is imported and searched locally; no client data is sent |
| Google (Gemini AI) | Adverse media screening | EU (europe-west1) | The following minimised data is sent to the model: full name of the screened person, birth year, country (citizenship / registration), and up to 3 aliases (first in full, remainder as initials). Addresses, document numbers, and contact details are not sent. Results are based on publicly available media sources. |
| Google Vertex AI | Automated document reading (Scan to Fill) | EU (europe-west1) | When scanning a client's identity document, the document image is sent to the Gemini 2.5 Flash model via Google Vertex AI. Extracted fields include: name, surname, date of birth, birth number, document number, address, and nationality. Google does not use this data for product improvement or model training. Processing takes place in the EU (europe-west1) under the Google Cloud Data Processing Addendum. |
| Anthropic Ireland, Limited | Internal Policy System generator | US (standard contractual clauses under Art. 46(2)(c) GDPR) | Only anonymised business information of the obliged entity, no personal data |
| MV ČR (Ministerstvo vnitra) | Document Validity Check (Invalid Documents Registry) | Czech Republic | Document type and number for validity check (CZ ID card, passport) |
| ARES | Company verification and quick data completion | Czech Republic | Czech company information, registration numbers, registration data |
| Meta, Google (Ads), Seznam (Sklik) | Marketing measurement, only with consent | depends on the provider (SCCs outside the EEA) | Cookies and device identifiers |
List changes: 22 Oct 2026 – Cloudflare, Inc. removed (upload protection is not used). 22 Oct 2026 – the Anthropic contracting entity clarified (Anthropic Ireland, Limited). 21 Oct 2026 – Microsoft, LinkedIn and marketing measurement providers added to the list; the Stripe contracting entity and the Anthropic service clarified. 9 Oct 2026 – Amazon Web Services EMEA SARL added (file backup, EU), effective from 8 Nov 2026.
International Data Transfers
Transfer Safeguards
- Standard Contractual Clauses (SCCs) for transfers outside the EEA
- Adequacy decisions where applicable
- Data Processing Agreements with all processors
- Regular compliance audits and assessments
Data Localization
Client data of obliged entities is processed and stored in the EU. It is transferred outside the EEA only to processors for which this is stated in the list, and only on the basis of standard contractual clauses.
Data Retention & Deletion
Compliance Records
10 Years
Records are retained for a period of 10 years according to the AML Act
Transaction Data
10 Years
Records of trades and ongoing monitoring of the business relationship are retained according to applicable retention periods under the AML Act.
Account Data
30 Days
User account data deleted within 30 days of account closure. Except for compliance records, which are subject to the statutory retention period under the AML Act.
Support requests
2 years after resolution
Support requests – 2 years after resolution. Unresolved requests are deleted 2 years after creation.
Business contacts
until unsubscribe, max. 3 years
Business contacts – until unsubscribe, at most 3 years without any response. After unsubscribing we keep only the e-mail address on a suppression list so that we do not contact you again.
Your Data Rights
Individual Rights
- Right of Access
Request copies of your personal data
- Right to Rectification
Correct inaccurate personal data
- Right to Erasure
Request deletion where legally permissible
- Right to Portability
Receive your data in a structured format
Regulatory Compliance Requirements
Some data rights may be limited by AML/CFT legal obligations. We are required to retain certain compliance records for regulatory periods, even after account closure.
Contact for Data Rights
To exercise your data rights, contact our privacy team:
Email: privacy@amlproof.ai
AML Proof, s.r.o. has not appointed a Data Protection Officer. Please direct any data protection questions to hello@amlproof.ai.
Questions About Data Processing?
If you have questions about how we process your data, our sub-processors, or want to exercise your data rights, please don't hesitate to contact us.