# Data Security and Privacy > What ReportingCloud stores and never stores: HTTPS-only connections, merge data in memory, Azure hosting, transfers outside the EEA, the GDPR and API keys. - **Product:** ReportingCloud - **Section:** Documentation - **Kind:** Topic - **Path:** ReportingCloud > Overview > Data Security and Privacy - **1529 words** - **Web URL:** https://docs.textcontrol.com/reporting-cloud/overview/security/ - **LLMs URL:** https://docs.textcontrol.com/reporting-cloud/overview/security/llms.txt - **LLMs-Full URL:** https://docs.textcontrol.com/reporting-cloud/overview/security/llms-full.txt --- Before you send customer data to a cloud service, you need to know how it travels, what is kept and where it is processed. ReportingCloud merges your data in memory and keeps only your templates, your account data and a log of your transactions. What follows covers the connections, what the service stores and what it doesn't, where it is hosted, what the services agreement says about personal data and the GDPR and how to keep your credentials safe. ### Security at a Glance | Topic | ReportingCloud | |---|---| | Connections | Encrypted, HTTPS only | | Merge data | Processed in memory and never stored | | Created documents | Created in memory, returned in the response and never stored | | Templates sent with a request | Unpacked in memory and deleted after the merge | | Templates in the storage | Kept in your account until you delete them. The servers are backed up daily. | | Transaction log | The metadata of each transaction, including the IP address it came from and the API key it used | | Hosting | Microsoft Azure. Personal data is transferred to countries outside the European Economic Area, including the USA. | | GDPR | A separate data processing agreement, on request | | Authentication | API keys, recommended, or the user name and password of the account | ### Encrypted Connections Every connection to ReportingCloud is encrypted with SSL/TLS. The Web API at `https://api.reporting.cloud/` is served over HTTPS only and accepts TLS 1.2 and TLS 1.3, not TLS 1.0 or 1.1. A plain HTTP connection to port 80 isn't answered. The ReportingCloud portal and the status page are HTTPS addresses as well. Your credentials, your merge data and the documents returned to you therefore never cross the network unencrypted. ### What ReportingCloud Stores The documents themselves are processed in memory: - **Merge data** is never stored. ReportingCloud merges it with the template and returns the result. - **Created documents** are created in memory and removed after the merge or conversion. The response is the only copy. - **A template sent with a request** in the request body is uploaded temporarily, unpacked in memory, merged and deleted after the merge. It is never written to the servers. What ReportingCloud does keep: - **Your account data**, such as your email address and the serial number of your subscription. - **The content of your template storage**: the templates and datasource excerpts that you upload or create, and the documents that you share from it. - **A transaction log.** Each transaction is logged with the IP address it came from and, when it used one, the API key. ReportingCloud keeps only this metadata of a transaction, not its data, and computes your quotas and statistics from it. The portal shows the transactions of the current month in the Transaction Monitor and the usage of earlier months in Statistics, which goes back to May 2018. See [Transactions and Statistics](https://docs.textcontrol.com/reporting-cloud/portal/statistics/llms-full.txt). ### Your Templates in the Storage Templates usually contain the layout and the merge fields of a document rather than sensitive data. For what you do keep in the storage, the services agreement and the reporting.cloud website say this: - **Ownership.** You keep all rights to the content that you upload. Text Control receives a license to it only to deliver the service to you. - **Access by Text Control.** The service is automated, and Text Control's personnel access content only as far as needed to answer your support requests, to address fraud, security or technical issues, to comply with legal requirements or to enforce the agreement. - **Viruses.** Text Control makes commercially reasonable efforts to block uploads that contain viruses. - **Backups and your own copy.** All servers are backed up every day, as the reporting.cloud website states. The agreement still asks you to keep a copy of everything you upload in another location, because stored content can be erased or corrupted. - **Confidential information.** If you keep confidential information or trade secrets in the service, you are responsible for safeguards beyond the security measures of the service. Keep personal data in the merge data of your requests, which isn't stored, rather than in templates. [Template Storage](https://docs.textcontrol.com/reporting-cloud/portal/templates/llms-full.txt) describes how you manage the storage. ### Hosting and Data Location ReportingCloud is hosted on Microsoft Azure. Depending on where you are and on the load of the servers, a request can be processed on servers in different countries. The services agreement states that personal data processed under it is transferred to countries outside the European Economic Area, including the United States, and by accepting the agreement you agree to this transfer. If documents and merge data have to stay on infrastructure that you control, ReportingCloud is not the right product: Text Control offers [DS Server](https://docs.textcontrol.com/ds-server/overview/introduction/llms-full.txt) as the on-premises solution. ### GDPR and the Data Processing Agreement Text Control commits to GDPR compliance for ReportingCloud and backs it with contractual commitments. If you act as a data controller under the GDPR and need a data processing agreement with the vendors that process personal data for you, Text Control provides a separate data processing agreement that follows the GDPR, Regulation (EU) 2016/679. To sign it, contact Text Control at , as section 8 of the services agreement states. Since 2018, accounts on a paid plan can also create the agreement themselves on the **Manage Account** page of the portal; see [Manage Account](https://docs.textcontrol.com/reporting-cloud/portal/account/#data-processing-agreement). You can read the [services agreement](https://portal.reporting.cloud/Documentation/License/) in the portal, and Text Control's general [privacy policy](https://www.textcontrol.com/company/privacy-policy/) on its website. ### Credentials and API Keys Every request authenticates with an `Authorization` header that holds either an API key or the user name and password of your account in a `Basic` header. Text Control recommends API keys: a key is a randomly generated string of more than 40 characters, keeps working when you change your password and can be replaced without touching the account or its other keys. [API Keys](https://docs.textcontrol.com/reporting-cloud/installation/api-keys/#why-use-api-keys) lists the reasons in full. Whoever has one of your API keys can use your account and its quota, so you keep a key as secret as a password. If a key is compromised, delete it and create a new one; your password stays as it is. The services agreement also makes you responsible for keeping your login information confidential. Because the Web API allows requests from web pages of any origin, a script in the browser could call it, but the key it sends would be visible to everyone who opens the page. Send requests that need your key from your server, and read the key from configuration rather than from your source code, as the samples of this documentation do with the environment variable `REPORTINGCLOUD_API_KEY`. [API Keys](https://docs.textcontrol.com/reporting-cloud/installation/api-keys/llms-full.txt) shows how to create keys, and [Authentication](https://docs.textcontrol.com/reporting-cloud/document-processing/authentication/llms-full.txt) how requests send them. ### Related Pages - [API Keys](https://docs.textcontrol.com/reporting-cloud/installation/api-keys/llms-full.txt): create and delete API keys in the portal. - [Authentication](https://docs.textcontrol.com/reporting-cloud/document-processing/authentication/llms-full.txt): the API key and Basic headers, with curl and SDK examples. - [Architecture](https://docs.textcontrol.com/reporting-cloud/overview/architecture/llms-full.txt): the Web API, the portal and the template storage. - [Plans and Licensing](https://docs.textcontrol.com/reporting-cloud/overview/licensing/llms-full.txt): the plans, their quotas and the usage rules of the services agreement. --- ## Nearby - **Previous:** [Plans and Licensing](https://docs.textcontrol.com/reporting-cloud/overview/licensing/llms-full.txt) - **Next:** [Installation Guide](https://docs.textcontrol.com/reporting-cloud/installation/llms-full.txt)