EU hosting & data residency
Primary invoice storage is configured in Frankfurt. Support, network and log processing by providers may take place elsewhere. Contact us for information about recipients and a copy of applicable transfer safeguards.
Security & compliance
A public trust overview for e-invoices, DATEV-adjacent workflows and firm handoffs.
This page separates live safeguards from planned hardening. It is intentionally plain: no ISO, SOC 2 or external pentest claims of our own until those attestations exist; certifications held by our data center operator (AWS) are named as such.
Live in the product
Encryption
Transport uses TLS 1.3; data at rest is protected with AES-256 by the hosting provider. Key and provider operations follow the hosting platform.
Checked with the official KoSIT validator
The parser is checked against the official KoSIT validator. This is not an external KoSIT certificate or KoSIT certification.
GoBD DB-level immutability
Original storage is available during active membership. After the paid period or free trial ends, customers have one month (30 days) to export their documents and then retain them under their own responsibility.
Structured audit log with redaction
Central audit events record security- and billing-relevant actions; log output is cleaned through central redaction helpers.
Prüfungsmappe / audit evidence pack
For each invoice a GoBD-oriented evidence pack can be downloaded: invoice identity, file provenance with SHA-256 checksum, validation result, processing and export timeline, the redacted audit trail and a retention summary — as Markdown or as a ZIP with the original file, with no write side effects.
Account-level 2FA
Supabase MFA is available and respected by the login flow when a second factor is enabled. Hardware-key enforcement is not live.
Custom domain & Mailgun routing
Custom-domain inboxes can be connected; routing is automated via Mailgun.
VAT ID checks via BZSt + VIES
Organizations can verify VAT IDs via BZSt and VIES; results are cached for 30 days.
Granular cookie consent
Analytics and marketing cookies are controlled by explicit consent and can be reopened from the footer.
HTTP security header hardening
Nonce-based CSP without unsafe-inline for scripts, HSTS preload, Permissions-Policy and COOP/COEP/CORP are active; CSP violations report to Sentry (EU/DE region).
Tenant-isolation negative tests
RLS negative tests cover invoices, suppliers, payment accounts, audit events and active-org cookie forgery with real Supabase clients.
Security event taxonomy & Sentry alerts
Auth, admin, payment-data, CSP and IBAN risk events use a typed security-event API; Sentry (EU/DE region) alert rules are documented in the ops runbook.
IBAN/BEC defense workflow
New supplier IBANs are checked against known history, risk-scored, shown in inbox/detail warnings and must be explicitly confirmed before payment-adjacent exports.
Public API hardening
API keys with hash storage (SHA-256 + server pepper), per-key rate limits on Upstash with fail-closed posture, signed outbound webhooks (HMAC-SHA256) with automatic deactivation after 5 consecutive failures – currently for test events; invoice events are not sent automatically yet.
Evidence instead of seals
What you can verify yourself
Instead of a seal, we show you how retention and checks work here – and where you can recompute them yourself.
Original unchanged
Every original file is stored with its SHA-256 checksum on receipt. On every download in the app, in every audit pack and on every hand-over to your tax firm it is checked against that checksum; if it differs, it is not delivered there.
Audit pack per invoice
For each invoice, a ZIP with the check report, the original file and checksums.sha256. You can recompute the checksums with your computer's built-in tools, without our software.
KoSIT report with version and scenario
The check report names the KoSIT validator's version and validation scenario; the validator's original report is included in the audit pack.
No official GoBD certificate
There is no official GoBD certificate for software; the German tax authorities do not issue attestations for software. Responsibility for proper bookkeeping stays with your company.
The sample contains invented data only. Its KoSIT report is a reconstruction, not output from a real validator run. Like every audit pack, it is in German.
Verify the checksums after unzipping, inside the folder: sha256sum -c checksums.sha256 (macOS: shasum -a 256 -c checksums.sha256).
The technical check supports, but does not replace, your own review of the invoice.
Security questions? Contact us via the imprint.
Imprint