Data handling
SET-SEC-030 · Version 1.0 · 2026-11-09
What data SET holds for a platform or merchant using its APIs, where it goes, and how to get it back or have it removed. SET's Privacy Policy governs personal data; this page is the technical summary a reviewer asks for.
1. What SET holds
| Category | What | Held as |
|---|---|---|
| Customer records | The identifiers the licensed provider assigns to a customer, its verification, accounts and addresses, and the status of each | Plain identifiers and statuses |
| Payments | Amount, currency, fees, state, dates, and the blockchain transaction or bank trace reference | Plain |
| The platform's own details | Legal name, address and identifier, sent with every movement as Travel Rule data | Plain |
| Payer details for the Travel Rule | Name and address of a payer a merchant names | Sealed (AES-256-GCM) |
| Payment references and metadata | A platform's own ids for its objects. Values that look like personal data are refused | Sealed, or plain opaque ids |
| API keys | A SHA-256 hash and a short prefix | Hash only |
| Audit log | Method, path, object, status, request id and time of each write. Never a request body | Plain |
2. What SET does not hold
- Identity documents, dates of birth, and government ID numbers collected for verification. These go to the licensed provider, which holds them.
- Full bank account numbers after a bank account is linked. SET keeps the provider's identifier for the account.
- Card numbers. Card payments are taken by the card processor.
- Wallet private keys.
3. Where data is processed
SET's application and database run on Cloudflare. Regulated services (verification, accounts, conversion, custody, payouts) are performed by SET's licensed infrastructure provider, and card payments by its card processor. The full list of subprocessors, with the purpose and location of each, is provided under a non-disclosure agreement and kept current for customers under contract.
4. Retention and deletion
- Payment and compliance records are kept for the periods in SET's AML/CTF programme, which law and SET's provider agreements require. They cannot be deleted on request within those periods.
- A customer can be closed by API (Customer lifecycle); its keys stop working at once.
- On termination, a platform can export its records by API (events, balance transactions, monthly statements, tax data) before its keys are revoked.
5. Access
- Production data is reachable only by SET's operator, behind single sign-on.
- The operator console shows statuses, identifiers and amounts. It cannot move money out of a wallet.
- A platform reaches only its own customers' records with its own keys. Every query is bound to the key's platform and to test or live mode.
6. Agreements
A data processing agreement and, where a customer needs them, standard contractual clauses are available for platforms under contract. Write to support@simpleeasytransactions.com.