Support access and data handling

This page explains in plain words how CFO Panorama's own staff may access your group and how your data are kept and deleted. It is guidance only and not part of any contract: the binding text is the data processing agreement (DPA) your group accepted, together with its annexes — see the legal documents. Which version applies to your group is recorded in your acceptance under Settings → Legal documents in the application.

How the software lets staff in

• Only CFO Panorama's platform superusers can open a client group they are not a member of. Other staff cannot.
• They sign in with a password and an authenticator code, and the code must be younger than 12 hours to work in a client group; otherwise a new code is asked for before anything is shown.
• Inside the group they work as an admin would: they can upload files, run and correct imports, map accounts, prepare reports and manage users, so that they see what you see. They never appear on your member list.
• Some acts stay yours alone and are refused on platform access: accepting or re-accepting the terms and the DPA, confirming companies under the agreement, ratifying, and requesting the deletion of your data.

What is recorded

Every time a platform user enters your group, it is recorded: the entry, each page they open (at most once per page and minute) and every action. Your admins read the record under Settings → Platform access log; changes they make also appear in the group's history with a mark that they were made on platform access. See Platform access log.

What the agreement says about staff access

The published versions differ, so both are summarised here:

• DPA version 1.2 (effective from 7 October 2026): staff access your data only to provide support at your request, to handle a security incident or to fix a fault in the service, and such access is logged (Article 5.2).
• DPA version 1.5 (published for 26 November 2026): by concluding the agreement you give a standing instruction for the necessary onboarding, reporting setup and operation, data import, mapping, diagnostics and support; a separate request or consent for each access is not needed. Authorised staff may have full administrator access to the extent necessary for those instructions; this technical capability does not widen the purpose, and business and accounting decisions remain yours (Articles 3 and 5, Annex B, part 3).

How long data are kept

The software's daily retention run deletes routine security records — platform access entries, report downloads and the platform's own request log — once they are 90 days old. The operational history of your reporting (imports, mappings, journals, member changes, including what staff did on platform access) is part of your data: it is kept while you use the service and deleted with your data.

DPA version 1.5 describes the same split: routine security and diagnostic records for at most 90 days, the reporting history as client data (Article 14).

When the contract ends, and deletion

Both published versions describe a 30-day export period after the contract ends, read-only, with one free export package on request. Database backups expire in their seven-day cycle; residual copies in Google's infrastructure may take up to 180 days to be physically erased in Google's own cycle. Version 1.5 adds that an authorised person can ask for earlier deletion at any time, which ends the export period to that extent (Article 14).

In the application, an authorised admin asks for deletion under Settings → Legal documents → Request deletion of all company data, with or without a 30-day read-only period first. See Legal documents.

AI features

The published documents state that client AI features are not active, and that any future AI feature would be enabled for a client only after notice and the client's express activation (DPA 1.5, Article 7.5). Your data are not used to train AI models (Article 3.5).

Questions

Write to support from the ? menu (Contact support), or to the data protection contact named in your DPA.