Security and privacy controls.

The published Render configuration sets the web service, the API, Postgres, and Redis to the Oregon region, in the United States. An EU region is not configured there. Whether the service will move, and which transfer terms apply, is not decided on this page.

Names, invoice numbers, amounts, VAT numbers, and the text read from a receipt are encrypted in the database. Sign-in uses a one-way index of the email, so the address is not stored in the clear. Dates, statuses, and currency codes stay readable so a period can be listed. Searching a name happens in the application after decryption, and only inside that account. After the account is deleted, a reduced retention row can keep a document number, amounts, a date, and a direction in the clear. It does not keep a name, an email address, or the file.

Account

email, name

Business profile

legal name, VAT code, company code, address, IBAN

Receipts

supplier name, supplier VAT and registration number, invoice number, net, VAT and gross amounts, VAT lines, extracted data, notes, custom category, team comment, journal account, file names

Issued invoices

number, buyer name, buyer code, buyer email, description, notes, line items, amounts

Bookkeeping

journal entries (document number, description, amount); bank lines (description, amount); known suppliers (name, VAT code, registration code); FR0600 amounts (fields 29, 30, 31, and 36); generated tax XML

Certificates

file names, passwords

Team invites

email

• Render: the site, the API, the database, and Redis, region Oregon.
• Mistral at https://api.eu.mistral.ai, only when an API key is set, for reading a receipt, turning one sentence into a draft, or transcribing a short recording. The code refuses the United States host, the global host api.mistral.ai, and the files and agents APIs. On 17 October 2026 the operator confirmed, from the Mistral admin privacy page, that the switch "use API calls to train Mistral models" is disabled and that Labs models are disabled. That training opt-out is active. Zero Data Retention has not been requested. This page does not treat it as active. Mistral's data-processing addendum has not been accepted here.
• The European Commission VIES service, when a VAT number is looked up and the lookup is not switched off.
• The open data set at get.data.gov.lt, for a company code, under the same lookup switch.

Subprocessors

The postal address, certificate number, VAT code, email, and phone are not published on this page. The Render and Mistral data-processing addenda have not been accepted here. Zero Data Retention has not been requested. The training opt-out is already confirmed. Whether production stays in Oregon is not decided on this page. Whether backups exist has not been confirmed here. The retention window has not been confirmed by counsel. Antivirus scanning does nothing until a scanner is configured.

No. The configuration file sets Oregon, in the United States. Moving it is an open decision.

Customers can turn an authenticator on. Administrators must, unless the deployment turns that rule off. This deployment does turn it off. A recovery code still works. An email code does not replace an authenticator that is already on.

Yes. Each receipt photo has its own key, wrapped by that account's data key. The data key belongs to the account, is not derived from the password, and is destroyed when the account is deleted. The personal and financial fields are encrypted as well. Dates, statuses, and currency codes are not. Render encrypts the Postgres disk, and the connection uses TLS when the database URL requires it. This is not a certification.

Receipt file copies are stored for 2 years from the document date; extracted fields and the journal stay. Statutory bookkeeping retention is your responsibility. In Lithuania that is generally 10 years; export copies you still need. This is not tax advice. In Settings you can download your data, delete stored files, delete stored records, or delete the account. Each deletion asks for the password again and a one-time email code. The code expires quickly and works once. Mail sending is not implemented, so in this deployment that code is written to the server log, not to an inbox. Deleting the account also deletes the files and the records, signs you out, and destroys that account's data key, so encrypted fields and files cannot be opened afterwards, including a backup copy of the ciphertext. Changing the password does not destroy the key. A reduced accounting row (a period, a number, a date, a direction, and amounts) may be kept apart from the account for a retention window (default 10 years). That window is a setting, and it is not a confirmed statutory period. The button does not delete provider backups.

The application refuses an internal purpose named training. On 17 October 2026 the operator confirmed, from the Mistral admin privacy page, that the switch "use API calls to train Mistral models" is disabled and that Labs models are disabled. That training opt-out is active. It is not Zero Data Retention. Zero Data Retention has not been requested. This page does not treat it as active. When a key is set, the receipt, the sentence, or the recording is sent to api.eu.mistral.ai.

No. The downloadable file is a draft for Article 28. It is not signed. It needs legal review. It is not a certification, and it does not say that Zero Data Retention is on.