Privacy
WipeShift is built around zero data retention: uploaded files are decoded and processed entirely in server memory for the duration of a single request and are gone when that request completes. File bytes and cell values are never written to disk, never logged, and never used to train any model.
What the AI mapping step sees
When a target field can't be matched deterministically, WipeShift asks a mapping agent to suggest a transformation. The agent receives your target schema and structural descriptors computed from your file's columns — data type, an anonymised example shape (e.g. John Doe becomes Aaaa Aaaa), length bounds, and cardinality. It never receives your actual cell values, row data, or the file itself. The suggested transformation is validated against a fixed, closed set of operations before it ever touches your data — the agent cannot invent an operation we don't already support.
What we store about your account
Your account stores identity data (email, auth metadata) and a personal organization. If you save a blueprint, we store the mapping recipe — source column names, target schema, transformation steps, and a structural fingerprint — never the rows or cell values that flowed through it.
Sub-processors
Two sub-processors see data derived from your use of WipeShift, both EU-based:
- Mistral (EU) — processes the structural metadata described above for AI-assisted mapping suggestions. File bytes and cell values never leave the request scope and are never sent to Mistral or any other third party.
- Supabase (EU) — hosts authentication and the Postgres database holding your account, organization, and saved blueprints.
Hosting
The application and conversion engine run on a self-hosted server in the EU; there is no Railway or other non-EU hosting involved. Reverse-proxy access logs record request timing and status only — never request bodies, so an uploaded file is never captured at the network layer either.
Logging
Server logs are structured and metadata-only: event names, error codes, counts, and durations. They never contain request bodies, file contents, or cell values — audited and enforced by an automated test that fails if a route ever logs a request body.