LFPDPPP · CFDI 4.0
Security & data of your practice.
Here's exactly what happens with your accounting practice's information once your account starts. No legalese. No compliance theater.
e.firma vault
Each taxpayer's e.firma lives encrypted in a vault using envelope encryption over AWS KMS: one key per practice and per taxpayer (its own encryption context), which only opens to download their CFDI or check the SAT portal. Every opening is logged with who, when, and for what.
Magda never uses your personal e.firma or signs on your behalf: she opens each taxpayer's to consult the SAT and, only when you order it, to fill in a form or open their tax mailbox. She never presses submit.
Hosting & data
Your data lives on Railway cloud infrastructure in the United States (us-east). This constitutes an international transfer that is necessary to fulfill our contractual relationship with you, which Mexican data protection law allows without additional consent.
- Backups
- Encrypted daily backups, 30-day retention. Recovery time objective (RTO) of 4 hours, recovery point objective (RPO) of 24 hours for transactional data of the practice.
- Encryption
- TLS 1.2+ in transit, AES-256 at rest. Logical separation per organization: each practice has its own isolated tenant in the database.
Subprocessors
For the service to work we need to rely on these providers. Each one is contractually bound to process your data exclusively for the described purpose and to LFPDPPP standards.
Railway
- Purpose
- Application hosting + database + backups
- Data shared
- All operational data of the practice
- Location
- United States
- Contract
- Signed DPA
Stripe
- Purpose
- Subscription payment processing
- Data shared
- Subscription ID only. Stripe captures the card directly.
- Location
- United States
- Contract
- Signed DPA
Resend
- Purpose
- Transactional email (signup, receipts, reminders)
- Data shared
- Recipient email, email content
- Location
- United States
- Contract
- Signed DPA
YCloud / WhatsApp Business API
- Purpose
- WhatsApp Business messages to the end client
- Data shared
- Client phone number, message template
- Location
- United States
- Contract
- Signed DPA
OpenRouter
- Purpose
- Access to AI models for drafting and validation
- Data shared
- Only the minimum context for each operation. Models are not trained on your information.
- Location
- United States
- Contract
- Signed DPA
Facturapi
- Purpose
- CFDI 4.0 for your Cumplida subscription invoices
- Data shared
- Practice's tax RFC and legal name, invoiced amount
- Location
- Mexico
- Contract
- Signed DPA
If we ever incorporate a new relevant provider, we add them here and to the Privacy Notice before transferring any data to them.
Access controls
- 2FA authentication
- TOTP-based 2FA available for every account in the practice. Recommended for the lead accountant.
- SSO / SAML
- Enterprise SSO (Google Workspace, Microsoft Entra ID, Okta) available on the Enterprise plan.
- Audit log
- Every action Magda performs on your behalf is recorded with timestamp, user, affected taxpayer, action type and result. Exportable to Excel whenever you ask.
Data processor agreement
Your firm is the data controller for its taxpayers' data and Cumplida is its processor. The agreement is published at cumplida.com/legal/data-processing and your firm's owner accepts it before Magda touches any of your taxpayers' data.
legal@cumplida.comStatus & incidents
We're preparing a public status page (status.cumplida.com) to report incidents in real time. In the meantime, write to soporte@cumplida.com and we respond in less than 4 business hours.
soporte@cumplida.comSomething doesn't add up?
Any technical question before buying: hola@cumplida.com · WhatsApp +52 33 1714 1785 · Cumplida, operated by Oscar Mizael Nuñez Garcia.
Contact