Your whole business lives here. We protect it accordingly.

Yes. Each installation runs on a server in the EU (for customers outside the EU, in their own region) with nightly backups to a separate server. Two-factor authentication, intrusion prevention, logged access and isolated databases protect your data in line with the GDPR.

For customers in the EU, on a server in the EU. Servers outside the EU exist only for customers outside the EU, each in the region with the best latency for their users. Your installation is isolated from other customers and backed up nightly to a separate server. For customers in the EU and the EEA, processing takes place within the EU and the EEA; any transfer to a third country requires your prior consent, as set out in the DPA.

Yes. The data processing agreement, the technical and organisational measures, the subprocessor list and the template of our annual security review are available for download below. You receive the signed DPA together with your licence agreement.

No, we do not hold an external certification. Our internal processes follow the control objectives of ISO 27001 and Art. 32 GDPR. They are reviewed annually and after every major system change against a documented checklist, and senior management signs off the results.

No later than the end of the licence agreement, or earlier on request, we hand your data over to you in a machine-readable format or delete it in line with data protection law, backups included, unless a statutory retention obligation applies. A deletion log is available on request. During the term you have full access to your data at all times.

Released invoices are unalterable and are never deleted; corrections run through cancellation invoices with their own number. Invoice numbering is sequential, with no gaps; every version of a document is kept with its author and timestamp, the released PDF is archived unchanged, and all access runs through personal accounts. In Spain invoices are registered with Verifactu. Record-keeping rules differ by country; documenting your own procedures remains your responsibility, and we provide the system description for it.