Security, hosting and data protection
What we protect, how, and what we never do with your data. The complete rules are in the privacy policy; this page gives you the essentials in one read.
Hosting in Belgium and the EU
- The service and its databases are hosted on infrastructure in Belgium and the European Union.
- No personal data is transferred outside the European Union.
- The Official Gazette acts are analysed by a language model running on our own servers: their text is not sent to a third-party AI service.
Passwords, keys and connections
- Every connection to the service is encrypted with TLS.
- Passwords are stored as bcrypt hashes, never in clear.
- API keys are stored as SHA-256 hashes and shown only once, when they are created. A revoked key stops working immediately.
- Sign-up attempts are rate-limited, and every request carries an identifier that lets us trace it.
Access inside your organisation
- Colleagues join your organisation by invitation, with a role that sets what they can do.
- Role changes, invitations and ownership transfers are recorded in an audit log the owner can read.
- Webhooks are delivered over HTTPS only, to public hosts, and signed with a secret you can rotate.
Payments
- Paid plans are paid by SEPA direct debit, through a mandate you sign online.
- Addrly never stores your IBAN: the signed mandate is held and archived by HVG Solutions, which issues the invoices.
- Bank details and signatures are removed from error reports before they leave the server.
Your data and your rights
- We do not sell or share your data, and we do not resell what you search for.
- You can download a complete export of your account data from your settings, and delete your account yourself.
- Detailed usage logs are kept for 60 days, then only as daily counts, without the content of the searches. Billing records are kept for 10 years, as accounting law requires.
- Our server logs record neither query strings nor IP addresses. For public company pages read without an account, only a salted hash of the IP address is kept, for at most 48 hours.
Public data about companies and people
- Company data comes from official Belgian registers and is reproduced as they publish it.
- A person named in a filing or a published act can object to their name appearing on Addrly through a dedicated form, without an account.
- Corrections to the registers themselves are made by the authority that keeps them.
Try it on your own customers
The free plan gives you 20 complete company dossiers every month, no card required. Move to a paid plan when you need more, and cancel whenever you like.
A question first? Contact us