Skip to main content
PayFi separates short-lived raw operation documents from long-term product and model-improvement data.

​
Raw operation documents

Production raw operation documents are stored in a Brazil-resident private S3-compatible bucket. The default production region is AWS sa-east-1. Operation upload objects use the operation-documents/... key prefix. PayFi deletes the raw object immediately after successful processing or terminal failure. During an eligible retry the object may remain for at most 24 hours; the production bucket lifecycle for operation-documents/* is a defense-in-depth upper bound, not the primary deletion mechanism. The expiry reconciler deletes overdue objects, audits the outcome, and emits a redacted failure event for alerting. A replay never renews retention. If the authorized input snapshot no longer exists, replay returns REPLAY_INPUT_UNAVAILABLE. Local Docker MinIO is only for development and test environments. Do not store raw partner documents on local SSDs, support inboxes, or unmanaged shared drives.

​
Model-improvement data

PayFi does not retain raw operation documents for hidden training. Long-term model-improvement data must be anonymized and contractually allowed by the customer DPA. Anonymized datasets must remove company names, person names, tax identifiers, account numbers, document IDs, and direct file references. Non-identifying transaction features such as modality, origin and destination countries, payment rails, and amount bands may be retained only when the customer contract permits it.

​
Human approval boundary

Automated analysis prepares evidence, requirement status, and risk signals for reviewers. It does not approve operations by itself. Final approval or rejection remains a human reviewer action. Reviewers are responsible for checking the evidence, resolving conflicts, and recording the final decision.