Data and access
Your accounting data in the European Union: where it is and who touches it.
The database, the files and the compute are in Frankfurt, and that we check rather than assert. Each document's bytes go to Anthropic to be read and the bot's pass through Telegram: that is written here too.
01Data and access
Where is my accounting data?
In the European Union: the database and the documents in Frankfurt, and the site's functions there too.
The database and the document store are in eu-central-1, Frankfurt, and the functions that serve the site run in the same region. The claim does not come from a label in a control panel: the server's name is resolved and its address compared against the ranges the infrastructure provider publishes. Two earlier attempts ended up in London and in Paris, and that is how they were seen.
What we do not say is that your data never leaves the European Union, because it would not be true. Hosted in the European Union, yes: database, files and compute. But to read a document its bytes travel to Anthropic, and an invoice that arrives through the bot passes through Telegram's servers first. Neither of those two is confined to the European Union.
- Database and documents
- Frankfurt, eu-central-1. Checked against the address ranges the provider publishes, not against a label.
- Compute
- The functions that serve the site are pinned to Frankfurt.
- What leaves the European Union
- The document's bytes, to the model that reads it. The bot's file, through Telegram. We say it here because a vendor questionnaire asks it first.
02Data and access
Can another firm see my invoices?
No, and it does not depend on the application remembering to filter: the boundary is inside the database.
Every table with accounting content carries the company it belongs to, and every query goes through a policy in the database itself that resolves to a single function: whoever is asking has to be an active member of that firm. The boundary is the firm, not the person: the owner and the administrators reach every company in the practice; an accountant, only the ones assigned. Given a query with no filter, the database drops the rows of other firms from it.
There are four paths that do not go through it, and they are named: the two public webhooks — the bot and the payments, which authenticate by cryptographic signature and not with a session — account deletion, and assigning a file that is waiting in the inbox. Four files, auditable. And the isolation has its own automated test, which runs with the rest and fails if one firm reaches another's data.
- The boundary is the firm
- The owner and the administrators see every company in the practice; an accountant, only the ones assigned.
- The read-only role
- It exists in the database and today it is denied. We would rather deny too much, which shows at once, than grant too much, which never shows at all.
- The webhooks
- The bot and the payments come in by cryptographic signature, never with a user's session.
- It is checked, not assumed
- An automated test tries to cross the boundary between two firms and fails if it manages to.
03Data and access
Who else processes my documents?
Six providers, each with its name and with what it receives.
Supabase holds the database, the documents and the accounts, in Frankfurt. Vercel runs the site in the same region. Anthropic receives the raw bytes of every invoice, every payslip and every PDF statement: that is where the product's AI is, a model that reads the document and proposes the fields, and what it does not settle stays in review until a person approves it. Telegram carries what you send through the bot.
Stripe handles the subscriptions and Resend only sends the contact form's email: neither of them sees your documents. On whether those documents are used to train models you will read neither a yes nor a no here: the subprocessor is Anthropic, and what counts in a vendor questionnaire is their own terms, not a sentence of ours.
- Supabase
- Database, document store and accounts. Frankfurt.
- Vercel
- Running the site, pinned to Frankfurt.
- Anthropic
- It receives the whole document in order to read it, and the summary of approved invoices the assistant answers from. Every piece of an invoice's text is handed to it marked as data, never as an instruction.
- Telegram
- Only if you use the bot: the file passes through their servers before we download it.
- Stripe and Resend
- The subscriptions and the form's email. If the email were misconfigured, your enquiry is saved all the same and the form says that nothing was sent.
04Data and access
How do you get into the account?
With email and password, or with Google. And a new account waits for a person to let it in.
Registration asks for the firm's name and its NIF, one firm per NIF. The Google button appears only when the identity provider is actually switched on: it is asked about before it is shown, because it was once advertised while switched off. Confirming an email proves that somebody has a mailbox, and says nothing about whether we want that person inside a product that holds other practices' accounting.
So we check every new account by hand. Until it is approved it can do nothing: not through the site, not through the bot, and the database itself refuses to create a company for it. It usually takes five to ten minutes during working hours. And an account that does not fit is blocked, not deleted, because a block can be undone and a deletion cannot.
- How you sign in
- Email and password, or Google when the provider is switched on. Password recovery and email confirmation, the standard flows.
- Approval by hand
- A new account does nothing until we have checked it. Five to ten minutes during working hours.
- Signed links
- Documents live in a private store and never at a public address: valid for an hour in the application, five minutes in the inbox.
05Data and access
Can I take my data out and delete the account?
Yes to both, and it is worth knowing exactly what each one means.
What the product builds is what exports: the received-invoice book and the 303 and 347 sheets in Excel, the single sheet and the invoice list in CSV, and the Libro Mayor in its own Excel. The originals, the PDFs and the photos, are downloaded one at a time with their signed link. What there is not is a button that brings the whole account down in one file.
Deleting the account really deletes: the user, the profile, the companies, the invoices, the statements and the chart of accounts, and each company's files are swept, the filed models' among them. Before deleting, which folders have to be swept is written down, so that a half-finished sweep leaves a record. And deletion is refused when that account owns a firm other active people still belong to.
06Data and access
What do we not promise?
What isolation inside the database cannot give, said before you ask.
There are no per-firm encryption keys of your own. There is no point-in-time restore for a single firm. And there is no immunity from another firm's load, because the database is shared. Those three are exactly what policy-based isolation does not reach, and the fourth — the paths that go around it — is named above instead of hidden.
Nor is an audit log written: the tables are there and nothing fills them yet. There is no document intake by email. And you will not read a regulatory-compliance sentence here: what there is, is what the code does, and every claim on this page can be checked against it.
- Per-firm encryption keys
- There are none. What there is: a private store, signed links that expire and a per-firm policy on every query.
- Point-in-time restore
- A single firm cannot be returned to an earlier moment without touching the others.
- Other people's load
- The database is shared. A noisy neighbour is noticeable, and saying so is more honest than promising otherwise.
- Audit log
- It is not written yet. If you need one for a client, tell us before you decide.
07Questions
What do gestorías and practices ask before trying it?
Is my data in the European Union?
Can another asesoría see my clients?
Are my documents at any public address?
Who processes my data besides you?
What is deleted when I delete the account?
Can I give a colleague at the practice access?
Send us the vendor questionnaire.
If a client asks you in writing where their data is and who processes it, pass those questions to us and we answer them one by one. And if you would rather see it from the inside first, the free plan does not expire and does not ask for a card.