Trust

Trust & Security Center

How we protect invoice data, keep processing compliant, and stay transparent.

This Trust Center provides an overview of our security and privacy practices. For the legally binding terms and full details, please refer to our Data Processing Agreement (DPA) and Privacy Policy.

Authoritative documents:

At a glance

EU-first hosting

Primary infrastructure is hosted in Frankfurt, Germany. Some sub-processors may process data in the EU/EEA and, where necessary, in third countries under Standard Contractual Clauses (SCCs).

Minimal retention

Invoice files are processed transiently. Diagnostic bundles for critical failed review or download flows can remain for up to 14 days.

Encrypted by default

TLS in transit and encryption at rest for stored metadata.

Operational assurance

Independent assurance: Invoice Converter does not currently hold a SOC 2 report or ISO 27001 certification.
Audits: We run internal control reviews and targeted external penetration checks.
Incident response: affected users are notified without undue delay.
Security contact: contact@invoice-converter.com

Data handling

PDF invoices are processed strictly for conversion and validation.
We minimize stored personal data and keep only what is required for accounts, billing, and support.
You can request deletion of account data via support.

Security controls

TLS encryption for all uploads and downloads.
Access controls and least-privilege for internal tools.
Continuous monitoring and logging for anomalies.

Privacy & compliance

GDPR-aligned processing with a Data Processing Agreement (DPA).
Validation checks for supported EN 16931 profiles.
Human review is still required when source data is incomplete or unclear.

Data residency

Primary infrastructure runs in Frankfurt (Germany). Where required for service delivery, sub-processors may process data in the EU/EEA and in third countries under SCCs.

Invoice files are processed transiently. For critical failed review/download flows, short-lived diagnostic bundles may be retained for up to 14 days; we do not keep a permanent invoice-content archive. Account data follows legal and contractual retention requirements.

Sub-processors

We use vetted providers for hosting, AI processing, payments, and analytics. For the authoritative list and processing locations, see the DPA (Annex 1) and the Privacy Policy.