Data and access
Hosted in the EU, in Frankfurt: where your accounting data is and who touches it.
The database, the files and the compute are in Frankfurt, and that we check rather than assert. Each document's bytes go to Anthropic to be read and the bot's pass through Telegram: that is written here too.
01Data and access
Where is my accounting data?
In the European Union: the database and the documents in Frankfurt, and the site's functions there too.
The database and the document store are in eu-central-1, Frankfurt, and the functions that serve the site run in the same region.
The claim does not come from a label in a control panel: the server's name is resolved and its address compared against the ranges the infrastructure provider publishes. Two earlier attempts ended up in London and in Paris, and that is how they were seen.
What we do not say is that your data never leaves the European Union, because it would not be true. Hosted in the European Union, yes: database, files and compute. But to read a document its bytes travel to Anthropic, and an invoice that arrives through the bot passes through Telegram's servers first. Neither of those two is confined to the European Union.
- Database and documents
- Frankfurt, eu-central-1. Checked against the address ranges the provider publishes, not against a label.
- Compute
- The functions that serve the site are pinned to Frankfurt.
- What leaves the European Union
- The document's bytes, to the model that reads it. Through Telegram, the bot's file and also the alert for every registration and sign-in, carrying the email address, the name, the firm and the IP. We say it here because a vendor questionnaire asks it first.
Comprobaciones del trimestre
3T 2026Gestoría Ejemplo Demo S.L. · B00000018
| Comprobación | Cifras | Estado |
|---|---|---|
| Libro Diario · debe = haber | 8.896,80 = 8.896,80 | Cuadra |
| Libro de IVA · soportado por tipos | 640,17 + 14,25 = 654,42 | Cuadra |
| Modelo 303 · devengado − deducible | -150,42 | A compensar |
| Extracto · movimientos conciliados | 6 | Conciliado |
| Extracto · sin documento | 2 | Revisar |
Example data, fictitious
Firma
3T 2026Libros de Gestoría Ejemplo Demo S.L. · B00000018 · 3T 2026
Revisado y conforme.
Example data, fictitious
02Data and access
Can another firm see my invoices?
No, and it does not depend on the application remembering to filter: the boundary is inside the database.
Every table with accounting content carries the company it belongs to, and every query goes through a policy in the database itself that resolves to a single function: whoever is asking has to be an active member of that firm.
The boundary is the firm, not the person: the owner and the administrators reach every company in the practice; an accountant does too, unless the owner or an administrator limits them to the ones assigned. Given a query with no filter, the database drops the rows of other firms from it.
Some server tasks do not go through it and use the database's service key. Among them: the two public webhooks — Telegram's, checked with a shared secret, and the payments one, with Stripe's signature —, each client's upload link, authenticated by its code, the nightly clean-up, account deletion, and assigning a file that is waiting in the inbox.
And the isolation has its own automated test, which runs with the rest and fails if one firm reaches another's data.
- The boundary is the firm
- The owner and the administrators see every company in the practice; an accountant does too, unless limited to the ones assigned.
- The webhooks
- The bot and the payments come in by cryptographic signature, never with a user's session.
- It is checked, not assumed
- An automated test tries to cross the boundary between two firms and fails if it manages to.
03Data and access
Who else processes my documents?
Six providers, each with its name and with what it receives.
Supabase holds the database, the documents and the accounts, in Frankfurt. Vercel runs the site in the same region.
Anthropic receives the raw bytes of every invoice, every payslip and every PDF statement: that is where the product's AI is, a model that reads the document and proposes the fields, and what it does not settle stays in review until a person approves it. Telegram carries what you send through the bot.
Stripe handles the subscriptions and Resend only sends the contact form's email: neither of them sees your documents. On whether those documents are used to train models you will read neither a yes nor a no here: the subprocessor is Anthropic, and what counts in a vendor questionnaire is their own terms, not a sentence of ours.
- Supabase
- Database, document store and accounts. Frankfurt.
- Vercel
- Running the site, pinned to Frankfurt.
- Anthropic
- It receives the whole document in order to read it, and the summary of approved invoices the assistant answers from. Every piece of an invoice's text is handed to it marked as data, never as an instruction.
- Telegram
- Two things, and the second does not depend on the bot. If you use the bot, the file passes through their servers before we download it. And every registration and every sign-in reaches us as an alert in a Telegram chat: the email address, the name, the firm, the country and the IP. It is an internal notice so we can action sign-ups, and it happens even if you never touch the bot.
- Stripe and Resend
- The subscriptions and the form's email. If the email were misconfigured, your enquiry is saved all the same and the form says that nothing was sent.
04Data and access
How do you get into the account?
With email and password, or with Google. And a new account waits for a person to let it in.
Registration asks for the firm's name and its NIF, one firm per NIF. The Google button appears only when the identity provider is actually switched on: it is asked about before it is shown, because it was once advertised while switched off.
Confirming an email proves that somebody has a mailbox, and says nothing about whether we want that person inside a product that holds the accounting of each firm's clients.
So we check every new account by hand. Until it is approved it can do nothing: not through the site, not through the bot, and the database itself refuses to create a company for it. And an account that does not fit is blocked, not deleted, because a block can be undone and a deletion cannot.
- How you sign in
- Email and password, or Google when the provider is switched on. Password recovery and email confirmation, the standard flows.
- Approval by hand
- A new account does nothing until we have checked it by hand.
- Signed links
- Documents live in a private store and never at a public address: valid for an hour in the application, five minutes in the inbox.
05Data and access
Can I take my data out and delete the account?
Yes to both, and it is worth knowing exactly what each one means.
What the product builds is what exports: the received-invoice book and the 303 and 347 sheets in Excel, the single sheet and the invoice list in CSV, and the Libro Mayor in its own Excel. The originals, the PDFs and the photos, are downloaded in a ZIP from each client's list. What there is not is a button that brings the whole account down in one file.
Deleting the account really deletes: the user, the profile, the companies, the invoices, the statements and the chart of accounts, and each company's files are swept, the filed models' among them.
Before deleting, which folders have to be swept is written down, so that a half-finished sweep leaves a record. And deletion is refused when that account owns a firm other active people still belong to.
06Data and access
What do we not promise?
What isolation inside the database cannot give, said before you ask.
There are no per-firm encryption keys of your own. There is no point-in-time restore for a single firm. And there is no immunity from another firm's load, because the database is shared. Those three are exactly what policy-based isolation does not reach, and the fourth — the paths that go around it — is named above instead of hidden.
The audit log is partial: it only records when an approved document goes back to review, and who did it. It does not cover edits or access. There is no document intake by email. And you will not read a regulatory-compliance sentence here: what there is, is what the code does, and every claim on this page can be checked against it.
- Per-firm encryption keys
- There are none. What there is: a private store, signed links that expire and a per-firm policy on every query.
- Point-in-time restore
- A single firm cannot be returned to an earlier moment without touching the others.
- Other people's load
- The database is shared. A noisy neighbour is noticeable, and saying so is more honest than promising otherwise.
- Audit log
- It only records when an approved document goes back to review, and who did it. If you need more for a client, tell us before you decide.
07Questions
What do gestorías and practices ask before trying it?
Is my data in the European Union?
Can another asesoría see my clients?
Are my documents at any public address?
Who processes my data besides you?
What is deleted when I delete the account?
Can I give a colleague at the practice access?
Data and access
Send us the vendor questionnaire.
If a client asks you in writing where their data is and who processes it, pass those questions to us and we answer them one by one. And if you would rather see it from the inside first, during the beta you start without paying anything, no card.