Trust

Trust & Security Center

How we protect invoice data, keep processing compliant, and stay transparent.

This Trust Center provides an overview of our security and privacy practices. For the legally binding terms and full details, please refer to our Data Processing Agreement (DPA) and Privacy Policy.

The documents listed under "Policies & agreements" are authoritative.

At a glance

EU-first hosting

DPA Annex 1 lists our backend hosting and database providers in the EU/EEA. Some sub-processors may process data in third countries under Standard Contractual Clauses (SCCs).

Documented retention

No permanent invoice archive. Retention depends on the workflow: 24 hours for External API results and download-reminder files (a failed External API task with a pending credit release is kept until that release completes), up to 14 days for diagnostic bundles, 30 days for quality evidence including source files, and up to 365 days for case and audit metadata.

Encrypted in transit

HTTPS/TLS protects uploads, downloads, and external service communication.

Operational assurance

Independent assurance: Invoice Converter currently has no independent security audit and no certification. It holds no SOC 2 report and no ISO 27001 certification.
Audits: customer reviews use remote evidence: the DPA, sub-processor list, technical and organisational measures, retention summary, incident process, and written security questionnaire responses.
Incident response: affected users are notified without undue delay.
Security and privacy contact: email contact@invoice-converter.com with the subject "Security". We send a first reply within 2 business days.

Data handling

PDF invoices are processed for conversion and validation, and for documented diagnostic and quality-assurance purposes within the retention periods described here.
We minimize stored personal data. Beyond accounts, billing, and support, we keep only time-limited diagnostic and quality-assurance evidence, as described in the retention section.
You can request deletion of account data via support.

Security controls

TLS encryption for all uploads and downloads.
Access controls and least-privilege for internal tools.
Rate limits, abuse controls, and security audit logging.
Multi-factor authentication (MFA) for all administrative and remote access.

Privacy & compliance

GDPR-aligned processing with a Data Processing Agreement (DPA).
Validation checks for supported EN 16931 profiles.
Human review is still required when source data is incomplete or unclear.

Data residency

DPA Annex 1 states the processing location of each sub-processor. Backend hosting and database providers are listed in the EU/EEA. Where required for service delivery, other sub-processors may process data in third countries under SCCs.

Retention & deletion

We do not keep a permanent archive of customer invoice documents. Retention depends on the workflow. Conversion tasks outside the External API are usually available for about 10 minutes after they finish. External API tasks and results, and finished files kept for the download reminder, are kept for 24 hours after the task ends or the file is saved. A failed External API task with a pending credit release is kept until that release completes. Diagnostic bundles for failed review or download flows are kept for up to 14 days. Quality-assurance evidence, including uploaded source files, expires 30 days after capture. Case metadata and audit findings, which can include affected invoice field values, are kept for up to 365 days. Account and billing data follow legal and contractual retention requirements. Enterprise customers can switch off invoice copies for quality assurance in their profile. From at most one minute after the switch, we keep no new copies of their invoices; conversions already running can finish under the previous setting, and copies stored earlier expire as described above.

Sub-processors

We use vetted providers for hosting, AI processing, payments, and analytics. For the authoritative list and processing locations, see the DPA (Annex 1) and the Privacy Policy.