How We Handle Your Data
& What We Stand For
At Alchex, we don't just process data — we protect it with the same rigor we bring to every audit. Here's what you need to know about our values, our commitments, and how we operate.
We Understand What's at Stake
Alchex provides audit analytics, process mining, and operational intelligence services. We understand that financial records, internal controls, and operational data are highly sensitive.
Protecting client data, ensuring confidentiality, and maintaining service continuity are core commitments of our company.
This isn't legalese — it's a promise. Everything we do is designed to honor the trust you place in us.
The Data We Handle (And Who Owns It)
In delivering our services, we may process financial records, ERP logs, transactional data, internal control documentation, compliance records, operational process data, and audit trails.
Here's what matters most: All client data is treated as Confidential Information, regardless of classification.
You retain full ownership of your data at all times. For what you put in your workspace, we are your data processor: we act only on your documented instructions, under a written data processing agreement.
For our own records (your users' sign-in accounts, billing and support contacts, and people who write to us or ask for information), Alchex is the data controller.
While your data belongs to you, we retain ownership of our proprietary tools, methodologies, templates, and analytical frameworks — the intellectual infrastructure we've built to serve you better.
What We Do With Your Data (And What We Never Do)
Client data is used strictly to perform audit analytics and process mining, identify control gaps and operational risks, generate reports and insights, and support your regulatory and compliance objectives.
We Never:
- Sell client data
- Use data for competitive purposes
- Access data beyond agreed scope
- Use client data to train public AI systems
What We May Do:
We may use anonymized and aggregated data to improve our services — but never in a way that identifies any client.
How We Protect Your Data
Both Alchex and its clients agree to protect confidential information and use it solely for agreed business purposes. Audit findings, operational insights, and analytical outputs are treated as confidential unless otherwise agreed in writing.
Our Security Measures:
Access to client systems and data is strictly limited to authorized personnel. No exceptions.
Prepared for the Unexpected
Alchex maintains documented Business Continuity and Disaster Recovery plans designed to ensure data integrity and service reliability.
- Encrypted backups
- Redundant infrastructure (where applicable)
- Defined recovery objectives
- Tested recovery procedures
- Formal incident response protocols
If something goes wrong: In the event of a security incident affecting client data, we'll notify you without undue delay, provide relevant information regarding the impact, take immediate mitigation steps, and cooperate with applicable legal or regulatory obligations.
Partners & Data Retention
Alchex may engage trusted infrastructure or service providers to support service delivery. All subprocessors are contractually bound by confidentiality, must maintain comparable security standards, and are subject to due diligence review.
Data retention is simple: Workspace data is kept while your contract runs and deleted within 30 days after it ends, unless you ask otherwise. Billing records are kept for 6 years, as tax law requires. Logs that contain personal data are kept no longer than 90 days.
Before your contract ends, you can export your data or ask us to delete it sooner. Clean, complete, and final.
The Privacy Laws We Follow
We follow the EU General Data Protection Regulation (GDPR), Turkey's Personal Data Protection Law No. 6698 (KVKK), and the US privacy laws that apply to us. Nothing on this page limits the rights those laws give you.
We use personal data only with a lawful basis: to perform our contract with you, for our legitimate interests (keeping the service secure, business-to-business sales), to meet a legal duty (such as keeping billing records), or with your consent (marketing email, which you can withdraw at any time).
Your Rights
You can ask to see the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, or to receive a copy to take elsewhere. Where we rely on your consent, you can withdraw it at any time.
Write to legal@alchex.com and we will answer within one month (30 days under KVKK). If your data is in a customer's workspace, we pass your request to that customer, who decides on it.
You may also complain to your data protection authority: in the EU, the supervisory authority where you live or work; in Turkey, the Personal Data Protection Board (KVKK Kurulu).
Where Your Data Goes
Our service runs on providers in the United States. When personal data of people in the EU leaves the EU, it is protected by the EU-US Data Privacy Framework where the provider is certified, or by the EU Standard Contractual Clauses. Personal data of people in Turkey leaves Turkey only as KVKK Article 9 allows.
Our providers (sub-processors) work under data processing agreements. Customers can ask us for the current list, and we tell them before we add a new one so they can object.
Our AI assistant reaches its models only through a gateway set to zero data retention: the model providers keep nothing and never train on your data.
Cookies
Our website sets no advertising or tracking cookies and shows no cookie banner, because it needs none. The Alchex app uses only the cookies needed to keep you signed in.
Liability & Compliance
Except in cases of gross negligence, willful misconduct, breach of confidentiality, or violation of applicable law, Alchex's liability is limited to fees paid during the preceding 12 months.
Both parties agree to comply with applicable data protection and financial regulatory requirements relevant to audit and process analysis engagements.
Our Values, In Practice
This isn't just policy — it's how we operate every day. Your trust is our most valuable asset, and we treat it accordingly.
Alchex is a Delaware company. Our contracts are governed by the laws of the State of Delaware, United States; your rights under the GDPR and KVKK still apply. Last updated 9 November 2026.