Trust & security
Fiatto is built privacy-first, in the EU, to GDPR-grade standards. This page summarizes our security posture, sub-processors and compliance status — the proof, not just the promise.
A security overview and sub-processor register are available self-service via the document room below; a signed DPA is available on request at security@fiatto.app.
In het kort (Nederlands)
Fiatto draait privacy-first in de EU (Frankfurt) en is AVG-conform, met een publiek AI-transparantieregister (EU AI Act). We claimen geen certificeringen die we niet hebben: SOC 2 is in voorbereiding — er is nog geen rapport — en ISO 27001 staat op de roadmap. Elke wijziging wordt op schaal getest; de beveiligingsmaatregelen, subverwerkers en documenten vind je hieronder in het Engels.
Compliance & certifications
GDPR
EU data protection. DPA and privacy notice available.
EU AI Act — transparency (Art. 50)
Public AI transparency register.
Data residency — EU (Frankfurt)
Customer data is hosted in the European Union.
CCPA / CPRA ready
Privacy controls for US customers.
SOC 2 Type II
Readiness program underway; report not yet issued.
ISO 27001
Planned after SOC 2.
We don't claim certifications we don't hold. SOC 2 is a readiness program in progress; the Type II report is not yet issued.
Security controls
Encryption
- AES-256-GCM application-layer encryption for the most sensitive secrets — accounting tokens, payroll PII, vendor TINs and tax-provider credentials.
- Separate encryption keys per purpose, held in the environment outside the database; fail-closed (no plaintext is ever stored).
- TLS in transit with HSTS enforced; encryption at rest on the managed database.
Access control
- Multi-factor authentication (TOTP), optionally enforced company-wide, with configurable trusted-device periods.
- Single sign-on (Google, Microsoft) and SCIM 2.0 user provisioning (Microsoft Entra ID).
- Role-based access control with granular, capability-level permissions enforced down to the database.
- Strict multi-tenant isolation via row-level security (per company), with an automated check for RLS coverage.
Audit & integrity
- Immutable, append-only audit log of who did what and when, readable only by admins.
- Append-only SHA-256 hash chains on the internal ledger and ESG registers — tamper-evident, with built-in verification.
- Two-person (four-eyes) approval and segregation of duties on sensitive actions (postings, bank-detail changes, lease decisions).
- Logged, fail-closed access to the most sensitive PII (e.g. payroll identifiers) — the access is recorded before any value is revealed.
Infrastructure & resilience
- EU-hosted (Frankfurt) on Supabase (PostgreSQL) and Vercel.
- Security headers (Content-Security-Policy, HSTS, X-Frame-Options), bot protection (Cloudflare Turnstile) and rate limiting.
- Error monitoring (Sentry) and a public status page backed by a live health check.
- Point-in-time recovery on the managed database plus storage backups.
Privacy & data lifecycle
- Self-service data export (data-subject access) and admin-driven anonymization (right to erasure).
- Configurable, automated data retention with scheduled anonymization of sensitive records.
- AI is optional per organization and never trains on your data; health data is excluded entirely. Personal data is minimized before an AI call wherever the feature allows it. Where a whole document must be read (for example to extract a certificate's validity date), sending it is an explicit, per-document choice by an administrator, who is told what leaves the platform.
- Company offboarding with a data purge after the agreed retention window.
Tested at scale
Every change runs a load-test gate in CI against a deterministically seeded mid-market dataset. The gate checks pagination completeness, that aggregates foot to independently computed totals, and that the core queries stay within their time budgets (median under 2s; the heaviest queries — full-table counts, scans and aggregations — under 4s) — all executed as a logged-in user with row-level security active. These are the volumes the suite actually seeds and tests:
We only publish what the suite certifies. Larger volumes may well work, but they are not covered by this gate — when we raise the tested volumes, this table changes with the test suite (the two are kept in lockstep by an automated check).
Sub-processors
The third parties that may process customer data. AI and integration providers are only involved when you enable that feature.
Core (always involved)
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, authentication, storage | All customer data (encrypted at rest) | EU (Frankfurt) |
| Vercel | Application hosting, CDN, logs | Request/error logs (no database access) | Global edge / EU |
| Resend | Transactional email | Email addresses, notification content | EU / US |
| Cloudflare | Bot protection (Turnstile), DDoS | IP address, challenge metadata | Global |
| Stripe | Subscription billing | Billing details, subscription events | EU / US |
| Sentry | Error & performance monitoring | Error metadata (configurable) | EU / US |
AI (optional — you choose the provider, or disable AI)
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Anthropic (Claude) | AI assistance — default; not used for model training | Documents/text only when AI is enabled | US |
| Microsoft Azure (OpenAI + Document Intelligence) | Alternative AI provider / OCR | Documents only when selected | EU |
| Google (Gemini) | Alternative AI provider — paid API; not used for model training | Documents/text only when selected | Global (no EU residency guarantee) |
| OpenAI | Embeddings (vector fingerprints) for companies on a Claude model — Anthropic offers no embeddings API; paid API, not used for model training | One derived line of text per record: invoice (supplier, number, date, amounts) or purchase request (title, justification). Never the documents themselves | Global (no EU residency guarantee) |
| xAI (Grok) | Alternative AI provider — paid API; not used for model training | Documents/text only when selected | United States (no EU residency guarantee) |
Integrations (only when connected)
| Provider | Purpose | Data | Region |
|---|---|---|---|
| Moneybird, AFAS, Exact, Twinfield, SAP, NetSuite, QuickBooks, Xero, Sage Intacct | Accounting bridge (post invoices, GL mapping). SAP, AFAS and NetSuite endpoints are customer-configured; an on-premise SAP is the customer's own system. | Invoice & supplier/customer data (names, invoice numbers, amounts, GL accounts) | EU / US |
| Nmbrs, Loket | Payroll integration (read-only import of payroll runs and payslips). Loket is selectable but does not transmit data yet. | Employee & payroll data (imported from the provider; no employee data is sent to it) | EU |
| TaxJar, Avalara | US sales-tax calculation | Address & amount for tax lookup | US |
| KvK, VIES, RDW, PDOK, BAG, EP-Online, WOZ | Data enrichment (company, VAT, vehicle, building registries) | Lookup keys (number, plate, address); VIES additionally receives the counterparty's name and address for the official name-match check | EU (NL/EU authorities) |
| Creditsafe | Credit information reports on business customers (bring-your-own connection, opt-in per company; natural persons/consumers excluded) | Counterparty identification sent for a lookup: company name, Chamber of Commerce number, country. The bureau report (score, rating, limit, status) is stored | EU/UK (Creditsafe Connect) |
| Enable Banking | Bank feed and payment initiation (PSD2) — only when the company connects a bank account | IBAN, account holder name, balances, transactions | EU |
| GoCardless Bank Account Data | Bank feed (PSD2) — legacy provider; existing connections only, no new sign-ups | IBAN, account holder name, balances, transactions | EU / UK |
| Storecove | Peppol access point for sending e-invoices — only when e-invoicing is enabled | Sales invoice (UBL): customer name, address, VAT/CoC number, lines and amounts | EU |
| Mollie | Payment service provider for invoice payment and iDEAL mandate verification — only when enabled | Amount, invoice reference, company name; payer name and IBAN are returned by Mollie | EU |
| Browser push services (Google, Mozilla, Apple) | Delivery of web-push notifications — only when a user enables push in their browser | Push endpoint, IP address, encrypted payload (no names or amounts) | Global (browser vendor) |
Recent changes
Moneybird, AFAS, Exact, Twinfield, SAP, NetSuite, QuickBooks, Xero, Sage Intacct — Updated
Accounting bridge entry corrected: Twinfield, SAP, NetSuite and Sage Intacct were already supported in the product but were missing from this register entry.
Nmbrs, Loket — Updated
Payroll entry clarified: the integration only imports payroll data (read-only); no employee data is sent to the provider. Loket is not transmitting data yet.
KvK, VIES, RDW, PDOK, BAG, EP-Online, WOZ — Updated
Enrichment entry corrected: the VIES check also transmits the counterparty name and address (name-match), not only a VAT number.
Enable Banking — Added
Added to the register after an audit of the outbound data flows in the codebase; this integration was already active but had not been listed.
GoCardless Bank Account Data — Added
Added to the register after an audit of the outbound data flows in the codebase; this integration was already active but had not been listed.
Mollie — Added
Added to the register after an audit of the outbound data flows in the codebase; this integration was already active but had not been listed.
Storecove — Added
Added to the register after an audit of the outbound data flows in the codebase; this integration was already active but had not been listed.
Browser push services (Google, Mozilla, Apple) — Added
Added to the register after an audit of the outbound data flows in the codebase; this integration was already active but had not been listed.
xAI (Grok) — Added
xAI Grok 4.5 added as a selectable AI model; only processes data for companies that choose it.
Creditsafe — Added
Creditsafe listed as a credit-information subprocessor: when a company connects its own Creditsafe account, customer name + Chamber of Commerce number + country are sent to fetch a credit report. Consumers/natural persons are excluded from automatic lookups.
Document room
Need the evidence pack for a vendor assessment? Request access to our gated document room: a generated security overview, the sub-processor register with change history, our DPA and SLA — plus an AI assistant that pre-fills your security questionnaire (DDQ) from our published posture, cutting assessments from weeks to hours.
Documents
Reporting a vulnerability
We welcome responsible disclosure. Email security@fiatto.app with details and steps to reproduce; please give us reasonable time to remediate before public disclosure. Our policy is published at /.well-known/security.txt.