Data & Privacy

Owner	Classification	Version	Effective	Next review	Status
Sekhar Prakash	Internal	0.1	2026-08-27	2026-11-27	Draft

Purpose. The authoritative source for what personal and financial data Finaisse processes, how it flows, and which third parties handle it. It supports GDPR/DPDP obligations, data-processing-agreement and subprocessor requests, and data-subject access or erasure requests.

Contents

• Records of Processing (RoPA) — data categories, purpose, lawful basis, retention (this page).
• → Data Flows — movement of data across services, the model boundary, and egress.
• → Subprocessors — third parties processing customer data.

Records of processing

Data category	Class	Purpose	Lawful basis	Location	Retention
Customer financial transactions and journals	Restricted	Core processing	Contract	In-region	To be defined
Personal identifiers (name, email, bank account)	Restricted	Matching and narration	Contract	In-region	To be defined

Where to start

Privacy and legal: records of processing and subprocessors. Engineering: data flows. Audit: all three, with Data Classification.

Related

• → Standards — Data Classification — the tier definitions
• → AI Governance — the model data-egress boundary
• → Architecture — Backend — how the data stores are built

Revision history

Version	Date	Author	Change
0.1	2026-08-27	Sekhar Prakash	Initial structure and seed inventory.

Finaisse Internal — Confidential. Not for external distribution.