Your data never leaves Europe.
Or your own schema.

In the European Union, and not just in transit: that is where it is stored. The database, the documents you upload and the mailbox you forward invoices to all sit on the same European infrastructure.

• Servers on European Union territory
• Hosted with a European provider, subject to the GDPR
• Your invoice mailbox is European too: mail arrives on that same machine
• Neither the database nor the files are replicated outside the European Economic Area

This is the real difference from almost anything else you will look at. The usual approach is a shared table with a «company» column and trust that no filter is ever forgotten. We give every company its own PostgreSQL schema.

• Every company gets its own schema, not one more row in a shared table
• The connection is bound to the signed-in company's schema before the first query runs
• A programming mistake cannot return another company's data: it is not within reach of that connection
• Whoever administers the platform has no company assigned, so they cannot open a session onto your books

What travels is encrypted and so is what is stored, starting with what hurts most to lose: the credentials that connect your bank and your mail.

• All traffic goes over HTTPS with our own certificate; there is no unencrypted way in
• Bank and mail credentials are stored encrypted with Fernet (authenticated AES): the database only ever sees ciphertext
• Passwords are stored with bcrypt, never in the clear: nobody can read them, ourselves included
• The encryption key lives outside the database; copying the database gets you nothing readable

Permission is not simply «in or out». There are three levels and, on top of them, page-by-page permission: your accountant can see Invoices and not see Payroll.

• Three levels: platform, company administration and employee
• Fine-grained per-page permission, so each person gets only their own part
• People join by two-step invitation and the temporary password expires on first sign-in
• Roles built for the trade: a bookkeeper and a sales lead see different things

When somebody asks months later why an invoice landed in one account and not another, the answer has to be written down. And it must not be rewritable.

• Every automatic reading is recorded in an append-only log: it is written, never corrected
• The invoices you issue are chained with a SHA-256 fingerprint (VeriFactu): touching one breaks the chain and it shows
• Periods already filed with the tax office are locked: they cannot be reopened by accident
• Messages that approve a payment are sealed: they cannot be edited or deleted

We use an AI provider to read your invoices, as a data processor. You should know exactly what leaves this building and what does not.

• The document to be read leaves, and nothing else: not your books, not your customer list
• Your documents are not used to train models; the processing is covered by contract and standard contractual clauses
• What is extracted comes back into your schema, not into a store shared between customers
• Every automatic decision is reviewable: you can see what was read and correct it

The GDPR grants you rights over your data. Most of them should not need an email or a wait: they are in the application.

• Access and portability: export your journal entries and your data to Excel whenever you like
• Rectification: anything the AI read can be corrected by hand, and the change is logged
• Erasure: closing the account drops your company's entire schema, it does not tick a box
• Everyone involved in the processing is listed in the privacy policy