Hosting in the EU
- Servers and database at Hetzner in Germany
- Daily encrypted backups, also in Germany
- All traffic over HTTPS, with HSTS
Security and privacy
Your invoices are safe with us
Invoices contain sensitive data, yours and your customers'. This is how we handle it.
Your account
- Sign in with a passkey, no password needed
- Two-factor authentication with an authenticator app, plus backup codes
- We reject passwords known from data breaches
- Protection against brute-force attacks
Your data
- Every user only sees their own data, checked on every request
- Issued invoices are immutable
- Important actions are recorded in an audit log
- You can export everything and delete your account
The app
- A strict Content Security Policy against script injection
- Input is validated, output is always escaped
- Uploaded logos are checked and sanitised
- Rate limiting on sign-in and the API
Privacy
- No tracking cookies, no advertising scripts
- We don't sell or share your data
- No AI reading along with your invoices
API and AI connections
- You see API keys once; you can revoke them any time
- The same permissions and checks as in the app
- Download links for PDF and UBL expire quickly
Our processors
Who we work with
A few parties process data for us, all with a data processing agreement. Your invoices and customers live in our database in Germany. Resend and Stripe belong to US companies, so extra safeguards apply.
| Party | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, database and backups | Germany |
| Resend, Inc. | Sending email | Sent from Ireland (EU); company and logs in the US |
| Stripe Payments Europe, Ltd. | Payments for Pro | Ireland (part of Stripe, Inc., US) |
Responsible disclosure
Found a vulnerability?
Thanks for helping. We're happy to work with researchers who follow these guidelines.
Email your finding to security@eenfactuurmaken.nl. Our contact details are also in /.well-known/security.txt.
Ground rules
- Give us reasonable time to fix the issue before you disclose it.
- Only use your own account or test accounts. Don't view, change or delete other people's data.
- No denial of service, social engineering, spam or physical attacks.
- We respond within three working days and keep you updated.
- If you follow these guidelines, we won't take legal action and we're happy to credit you if you'd like.
Done with invoices in Word?
Make your first 5 invoices for free. No credit card, no trial that runs out. Promise.