Privacy policy
In force since 1 January 2026
What we process
A3.Drive stores customer files, their versions and metadata: name, type, size, content hash, creation and modification time, and information about the holders of the object. User identity is kept separately: the link between a local account and A3.ID, the role, the department and blocking flags.
Where the data sits
The storage region is set when the organization is created and does not change afterwards without an explicit migration procedure. Organization data does not leave its region, and backups are kept there too. Exchange between products of the ecosystem happens inside the account region.
Who has access
Access to an object is determined by permissions stored in A3.Drive. Products and integrations receive not the whole storage but permissions to specific objects and folders. Hiding an attachment from listings is presentation and never replaces a permission check.
Retention and deletion
An object lives while it has at least one holder. After the last holder is removed the object goes to the trash and is erased when the trash period expires. A legal retention period set by the document workflow layer holds the object even when no holders remain.
Transfer to third parties
We do not pass file contents to third parties. A call to an external service in another country is treated as a cross border transfer and requires a separate basis. Public links are created deliberately by the owner and revoked by the owner at any moment.
Customer rights
A customer may export their data, revoke issued public links and integration permissions, and request deletion to the extent that does not conflict with established retention periods.