The same infrastructure your bank uses.

Hosted on Google Cloud, in the EU.

WorkTiles runs on Google Cloud Platform - the same infrastructure powering large parts of the regulated financial industry. Your data stays in the EU region, which keeps GDPR and Swedish data-residency requirements straightforward.

• Encrypted at rest and in transit All data - databases, files, backups - is encrypted by default. TLS for everything you send or download.
• EU data residency Stored in Google Cloud's European region. No data leaves the EU without a written agreement.
• Backed by GCP's 99.95% SLA Regional availability with a read replica for redundancy. Failover is built into the platform.

Backed up daily, recoverable to the minute.

We treat your close, your reconciliations, and your audit trail like the asset they are. Backups are automatic, retention is generous, and point-in-time recovery means we can restore to any moment if something goes wrong.

• Automatic daily database backups Full PostgreSQL backups every night at 00:00 UTC.
• Point-in-time recovery Restore the database to any specific moment, not just to the last backup.
• 90-day backup retention Historical recovery available for up to 90 days. Deletion protection prevents accidental drops.
• 90-day soft-delete on files Even "deleted" files (trial balances, bank statements, evidence) are recoverable for 90 days.

Multi-factor by default. Isolated by organization.

Authentication runs through Clerk, with MFA available to every user and required for accounts that need it. Permission is scoped to your organization - users can only see what belongs to your team.

• Multi-factor authentication MFA is supported for every account. Required for sensitive actions and admin roles.
• Organization-based isolation Strict data boundaries between organizations - nobody outside your org can see your data.
• Team-based permissions Internal access controls - split duties across teams without giving everyone access to everything.
• External-user access for auditors Auditors get scoped access to exactly what they need, with the same audit trail as everyone else.
• Signed URLs for files Document downloads use time-limited signed URLs. No permanent public links.

Every change logged, forever.

Every action in WorkTiles is logged with the user, timestamp, and what changed. Approvals - manual and AI-assisted - are permanently recorded. Reconciliation history is versioned. The audit trail is the system, not a separate report.

• Full change log Who did what, when, and what it looked like before. Forever.
• Versioned reconciliations Full history of every upload, every adjustment, every modification.
• Approval tracking Every approval - manual or AI-assisted - is permanently logged with the approver.
• Auditor exports One-click Excel + ZIP exports of everything an auditor needs, including all attached documents.

GDPR-compliant. Auditor-ready.

We handle personal data per GDPR - including the right to erasure. Your audit trail is structured to satisfy what auditors and regulators actually ask for, and we can sign DPAs for customers who need them.

• GDPR-compliant data handling Right to erasure, data portability, and clear data-processing terms.
• Swedish data storage EU region - meets Swedish legal residency requirements for financial data.
• Continuous monitoring Automatic alerts on errors and security-relevant events. Logs are retained for review.
• Managed updates Security patches via GCP's managed services - we don't run unpatched infrastructure.

Questions, audits, or DPAs?

If your security or compliance team needs more - full security questionnaire, signed DPA, custom data-processing terms, or a deeper architecture review - book a call and we'll work through it.