Trust & security
Fiatto is built privacy-first, in the EU, to GDPR-grade standards. This page summarizes our security posture, sub-processors and compliance status — the proof, not just the promise.
A security overview and sub-processor register are available self-service via the document room below; a signed DPA is available on request at security@fiatto.app.
In het kort (Nederlands)
Fiatto draait privacy-first in de EU (Frankfurt) en is AVG-conform, met een publiek AI-transparantieregister (EU AI Act). We claimen geen certificeringen die we niet hebben: SOC 2 is in voorbereiding — er is nog geen rapport — en ISO 27001 staat op de roadmap. Elke wijziging wordt op schaal getest; de beveiligingsmaatregelen, subverwerkers en documenten vind je hieronder in het Engels. Bij een eigen AI-API-sleutel (BYOK) loopt die verwerking onder jullie contract met de provider — zie privacyverklaring §5.
Compliance & certifications
GDPR
EU data protection. DPA and privacy notice available.
EU AI Act — transparency (Art. 50)
Public AI transparency register.
Data residency — EU (Frankfurt)
Customer data is hosted in the European Union.
CCPA / CPRA ready
Privacy controls for US customers.
EN 301 549 / WCAG 2.1 AA (accessibility)
Partially conformant; self-assessed with automated gates in CI. See the accessibility statement for the known gaps.
SOC 2 Type II
Readiness program underway; report not yet issued.
ISO 27001
Planned after SOC 2.
We don't claim certifications we don't hold. SOC 2 is a readiness program in progress; the Type II report is not yet issued. Read the accessibility statement for our conformance status against EN 301 549, including what we have not verified.
WCAG 2.2 AA — audit status
Not yet assessed · 0 of 55 criteria pass
Security controls
Encryption
- AES-256-GCM application-layer encryption for the most sensitive secrets — accounting tokens, payroll PII, vendor TINs and tax-provider credentials.
- Separate encryption keys per purpose, held in the environment outside the database; fail-closed (no plaintext is ever stored).
- TLS in transit with HSTS enforced; encryption at rest on the managed database.
Access control
- Multi-factor authentication (TOTP), optionally enforced company-wide, with configurable trusted-device periods.
- Single sign-on (Google, Microsoft) and SCIM 2.0 user provisioning (Microsoft Entra ID).
- Role-based access control with granular, capability-level permissions enforced down to the database.
- Strict multi-tenant isolation via row-level security (per company), with an automated check for RLS coverage.
Audit & integrity
- Immutable, append-only audit log of who did what and when, readable only by admins.
- Append-only SHA-256 hash chains on the internal ledger and ESG registers — tamper-evident, with built-in verification.
- Two-person (four-eyes) approval and segregation of duties on sensitive actions (postings, bank-detail changes, lease decisions).
- Logged, fail-closed access to the most sensitive PII (e.g. payroll identifiers) — the access is recorded before any value is revealed.
Infrastructure & resilience
- EU-hosted (Frankfurt) on Supabase (PostgreSQL) and Vercel.
- Security headers (Content-Security-Policy, HSTS, X-Frame-Options), bot protection (Cloudflare Turnstile) and rate limiting.
- Error monitoring (Sentry) and a public status page backed by a live health check.
- Point-in-time recovery on the managed database plus storage backups.
API lifecycle
- The public API is versioned in the path (/api/v1). Every response carries a Fiatto-API-Version header stating which version served it.
- If a version is ever retired we announce it at least 12 months in advance. From the announcement onward, responses from that version carry Deprecation (RFC 9745) and Sunset (RFC 8594) headers, so an integration can detect it without reading a changelog.
- Additive changes (new endpoints, new optional request fields, new response fields) ship within a version; anything that removes or narrows behaviour requires a new version. The full policy is published in the OpenAPI document at /api/v1/openapi.json.
- Exception: a change required to fix a security problem may ship without the notice period. We report such a change afterwards and keep it as narrow as possible.
Privacy & data lifecycle
- Self-service data export (data-subject access) and admin-driven anonymization (right to erasure).
- Configurable, automated data retention with scheduled anonymization of sensitive records.
- AI is optional per organization and never trains on your data; health data is excluded entirely. Personal data is minimized before an AI call wherever the feature allows it. Where a whole document must be read (for example to extract a certificate's validity date), sending it is an explicit, per-document choice by an administrator, who is told what leaves the platform. Bring-your-own-key (BYOK): when a company connects its own Anthropic, Azure OpenAI (chat, optional embeddings deployment, and optional Document Intelligence OCR), Gemini, xAI or OpenAI (embeddings) credentials, those calls run under the customer's contract with the provider; Fiatto remains processor for data in the platform.
- Company offboarding with a data purge after the agreed retention window.
Tested at scale
Every change runs a load-test gate in CI against a deterministically seeded enterprise-volume dataset: one organisation with 10× the transaction volume of a mid-market company, the same master data. The gate checks pagination completeness, that aggregates foot to independently computed totals, and that the core queries stay within their time budgets — all executed as a logged-in user with row-level security active. Index-served paths keep a flat budget regardless of volume: list pages, including deep ones, under 2s, and period reporting, which reads maintained balances rather than raw journal lines, under 1s. Full scans and aggregations get a budget that grows with the volume: 2s and 4s per 200,000 journal lines, so 20s and 40s at the tested volume. These are the volumes the suite actually seeds and tests, on every pull request:
We only publish what the suite certifies. Larger volumes may well work, but they are not covered by this gate — when we raise the tested volumes, this table changes with the test suite (the two are kept in lockstep by an automated check). What the gate does not measure: concurrent users, write throughput, and multi-entity consolidation at this volume — and it runs on a CI database, not on the production instance.
Sub-processors
The third parties that may process customer data. AI and integration providers are only involved when you enable that feature. Where a customer connects its own AI API key or Azure OpenAI resource (BYOK, opt-in after Fiatto platform approval), processing for those calls occurs under the customer's contract with the provider — Fiatto is not the sub-processor for that traffic. Public bots without company context stay on Fiatto's keys.
Core (always involved)
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, authentication, storage | All customer data (encrypted at rest) | EU (Frankfurt) |
| Vercel | Application hosting, CDN, logs | Request/error logs (no database access) | Global edge / EU |
| Resend | Transactional email | Email addresses, notification content | EU / US |
| Cloudflare | Bot protection (Turnstile), DDoS | IP address, challenge metadata | Global |
| Stripe | Subscription billing | Billing details, subscription events | EU / US |
| Sentry | Error & performance monitoring | Error metadata (configurable) | EU / US |
AI (optional — you choose the provider, or disable AI)
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Anthropic (Claude) | AI assistance — default via Fiatto platform key; not used for model training. BYOK (opt-in): customer's own Anthropic API key; those calls run under the customer's contract with Anthropic | Documents/text only when AI is enabled | US |
| Microsoft Azure (OpenAI + Document Intelligence) | Alternative AI provider / OCR. Chat via Fiatto Azure by default, or customer's own Azure OpenAI resource when BYOK is connected (optional separate embeddings deployment; optional Document Intelligence OCR on the customer's Cognitive Services resource); otherwise Document Intelligence stays on Fiatto | Documents only when selected | EU |
| Google (Gemini) | Alternative AI provider — paid API; not used for model training. BYOK (opt-in): customer's own Gemini API key; those calls run under the customer's contract with Google | Documents/text only when selected | Global (no EU residency guarantee) |
| OpenAI | Embeddings (vector fingerprints) for companies on a Claude model — Anthropic offers no embeddings API; default via Fiatto platform key, or customer's own OpenAI API key when BYOK is connected; paid API, not used for model training | One derived line of text per record: invoice (supplier, number, date, amounts) or purchase request (title, justification). Never the documents themselves | Global (no EU residency guarantee) |
| xAI (Grok) | Alternative AI provider — paid API; not used for model training. BYOK (opt-in): customer's own xAI API key; those calls run under the customer's contract with xAI | Documents/text only when selected | United States (no EU residency guarantee) |
Integrations (only when connected)
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Moneybird, AFAS, Exact, Twinfield, SAP, NetSuite, QuickBooks, Xero, Sage Intacct | Accounting bridge (post invoices, GL mapping). SAP, AFAS and NetSuite endpoints are customer-configured; an on-premise SAP is the customer's own system. | Invoice & supplier/customer data (names, invoice numbers, amounts, GL accounts) | EU / US |
| Nmbrs, Loket | Payroll integration (read-only import of payroll runs and payslips). Loket is selectable but does not transmit data yet. | Employee & payroll data (imported from the provider; no employee data is sent to it) | EU |
| TaxJar, Avalara | US sales-tax calculation | Address & amount for tax lookup | US |
| KvK, VIES, RDW, PDOK, BAG, EP-Online, WOZ | Data enrichment (company, VAT, vehicle, building registries) | Lookup keys (number, plate, address); VIES additionally receives the counterparty's name and address for the official name-match check | EU (NL/EU authorities) |
| Creditsafe | Credit information reports on business customers (bring-your-own connection, opt-in per company; natural persons/consumers excluded) | Counterparty identification sent for a lookup: company name, Chamber of Commerce number, country. The bureau report (score, rating, limit, status) is stored | EU/UK (Creditsafe Connect) |
| Enable Banking | Bank feed and payment initiation (PSD2) — only when the company connects a bank account | IBAN, account holder name, balances, transactions | EU |
| GoCardless Bank Account Data | Bank feed (PSD2) — legacy provider; existing connections only, no new sign-ups | IBAN, account holder name, balances, transactions | EU / UK |
| Storecove | Peppol access point for sending e-invoices — only when e-invoicing is enabled | Sales invoice (UBL): customer name, address, VAT/CoC number, lines and amounts | EU |
| Mollie | Payment service provider for invoice payment and iDEAL mandate verification — only when enabled | Amount, invoice reference, company name; payer name and IBAN are returned by Mollie | EU |
| Browser push services (Google, Mozilla, Apple) | Delivery of web-push notifications — only when a user enables push in their browser | Push endpoint, IP address, encrypted payload (no names or amounts) | Global (browser vendor) |
Recent changes
Microsoft Azure (OpenAI + Document Intelligence) — Updated
AI BYOK disclosure: Azure OpenAI BYOK may include a separate embeddings deployment on the customer's resource; Document Intelligence OCR remains on Fiatto.
OpenAI — Updated
AI BYOK disclosure: Claude companies may connect their own OpenAI API key for embeddings; those calls run under the customer's contract with OpenAI.
Anthropic (Claude) — Updated
AI BYOK disclosure: when a company connects its own Anthropic API key, those calls are under the customer's contract with Anthropic (Fiatto is not the sub-processor for that traffic).
Microsoft Azure (OpenAI + Document Intelligence) — Updated
AI BYOK disclosure: Azure OpenAI chat may use the customer's own resource (BYOK); Document Intelligence OCR remains on Fiatto's platform key.
Google (Gemini) — Updated
AI BYOK disclosure: when a company connects its own Gemini API key, those calls are under the customer's contract with Google.
xAI (Grok) — Updated
AI BYOK disclosure: when a company connects its own xAI API key, those calls are under the customer's contract with xAI.
Moneybird, AFAS, Exact, Twinfield, SAP, NetSuite, QuickBooks, Xero, Sage Intacct — Updated
Accounting bridge entry corrected: Twinfield, SAP, NetSuite and Sage Intacct were already supported in the product but were missing from this register entry.
Nmbrs, Loket — Updated
Payroll entry clarified: the integration only imports payroll data (read-only); no employee data is sent to the provider. Loket is not transmitting data yet.
KvK, VIES, RDW, PDOK, BAG, EP-Online, WOZ — Updated
Enrichment entry corrected: the VIES check also transmits the counterparty name and address (name-match), not only a VAT number.
Enable Banking — Added
Added to the register after an audit of the outbound data flows in the codebase; this integration was already active but had not been listed.
Document room
Need the evidence pack for a vendor assessment? Request access to our gated document room: a generated security overview, the sub-processor register with change history, our DPA and SLA — plus an AI assistant that pre-fills your security questionnaire (DDQ) from our published posture, cutting assessments from weeks to hours.
Documents
Reporting a vulnerability
We welcome responsible disclosure. Email security@fiatto.app with details and steps to reproduce; please give us reasonable time to remediate before public disclosure. Our policy is published at /.well-known/security.txt.