On Google Cloud, isolated per company, with verifiable evidence.
PLDUnity runs on Google's infrastructure (Firebase and Google Cloud), with no servers to manage, and every action goes into an audit log that only the system can write.
Where it is hosted
- Google CloudLive
United States region (us-central1), on Firebase: authentication, database, file storage, hosting and cloud functions.
- Relational databaseLive
Cloud SQL (PostgreSQL) for reporting and analytics, synced with the main database.
- No servers of our ownLive
Capacity scales with demand and is billed by use.
- BackupsLive
Automatic every week, with file versioning.
Security
- Isolation per companyLive
Data and file access rules prevent one company from seeing another's information.
- Roles and permissionsLive
Owner, administrator, analyst, read-only and external auditor with an expiry date.
- Two-factor authentication (TOTP)Live
Mandatory for platform administrators and available to every user.
- Audit logLive
Every relevant action (uploads, reports, role changes, exports) is recorded, and only the server can write it.
- IntegrityLive
Report XML files, acknowledgments and export packages carry a SHA-256 fingerprint to prove they were not altered.
- Application securityLive
HTTP security headers, API keys stored only as hashes and webhooks signed with HMAC-SHA256.
- EncryptionLive
In transit (HTTPS) and at rest, the Google Cloud standard.
- RetentionLive
10-year backup through a complete, portable export, in parts, with an integrity fingerprint.
The process, end to end
- ETAPA 01
Input
Official template, AI-assisted upload or API. Everything comes in through the same channel.
- ETAPA 02
Validation
Each row is checked against SAT catalogs and the rules of the law before it is saved; anything that fails is rejected with an explanation.
- ETAPA 03
Rules engine
Thresholds in the year's UMA, monthly and semiannual aggregation, cash cap, risk level and the matching queue.
- ETAPA 04
Reports
The XML is built per activity and validated against the SAT's official schema; if it does not validate, it is not marked as filed.
- ETAPA 05
Evidence
Linked acknowledgments, audit log, fingerprints and export for an audit or 10-year retention.
Artificial intelligence
AI suggests; the compliance officer confirms.
We use Google models (Gemini) for three tasks: recognizing the columns of any transaction file, reading IDs and tax certificates, and comparing the face on the ID with a selfie. In every case a person makes the final decision. The compliance assistant answers questions about the LFPIORPI with the same technology.
Quality and continuity
- automated tests
- 628
- Run before every deployment; XML files are checked with the official validator.
- cloud functions
- 182
- With autoscaling.
- between health checks
- 10 min
- Continuous integration and deployment, with constant monitoring.
Integration
- Public API to receive transactionsLive
- Signed webhooks to notify your systemsLive
- Monday.com integrationLive
- CRM and ERP connectors in development (2027)Deadline: Mar 2027
FREQUENTLY ASKED QUESTIONS
Frequently asked questions about security, cloud, and architecture
Where is data hosted and how is client confidentiality protected?
PLDUnity runs on enterprise Google Cloud infrastructure with TLS 1.3 encryption in transit and AES-256 encryption at rest. Every organization is isolated at both the database and object-storage layers so no other tenant can ever access your files.
How does the platform prove to the SAT that a document or receipt has not been tampered with?
The moment a KYC document, XML notice, or SAT receipt is uploaded, the system computes and stores its SHA-256 cryptographic hash alongside an immutable timestamp. During a regulatory inspection or external audit, this hash mathematically proves the file has remained unaltered since ingestion.
How does PLDUnity use Artificial Intelligence and is my data used to train public models?
We use enterprise Google Gemini models inside Google Cloud for three scoped tasks: OCR extraction on KYC documents, assisted Excel column mapping, and the LFPIORPI regulatory assistant. Your data is never used to train public models, and every AI output requires human confirmation.
Can I export all my information if I ever decide to leave the platform?
Yes—your data belongs entirely to you. At any time you can export a complete, structured archive containing your client directory, original KYC documents, transaction history, EBR matrices, XML notices, SAT receipts, and audit logs in standard formats (JSON, CSV, XML, and PDF).
Who can view client files inside my organization and how is access audited?
Role-Based Access Control (RBAC) restricts every view by role (Compliance Officer, Analyst, Cashier, or External Auditor). Furthermore, the audit log is append-only: recording who viewed, created, edited, or downloaded any record with exact timestamp and IP address—impossible for even administrators to delete.
How do you guarantee accuracy across UMA thresholds, accumulation rules, and SAT XSD schemas?
Our engineering pipeline runs 628 automated unit and integration tests validating 6-month rolling accumulation logic, Article 32 cash restrictions, EBR weight calculations, and all 19 official SAT XSD schemas prior to every release.
Do you provide a REST API to connect our proprietary core system or ERP?
Yes. We provide token-authenticated REST endpoints (with scoped permissions and rate limiting) to register clients, run synchronous watchlist screenings, ingest transactions, and receive real-time events via HMAC-SHA256 signed webhooks.
Does your IT team want to review the architecture?
Book 30 minutes with the BDUnity team · info@pldunity.com