Security
Your books belong to you. This is how we keep them safe, complete and yours at all times.
Where your data lives
- Servers and backups at Hetzner in Germany (ISO 27001 certified data centres); we pass no content to third countries.
- PDF generation, virus scanning, text recognition and receipt recognition run on our own servers: no third-party AI, no external recognition services.
- Every connection is TLS encrypted; backups are stored encrypted (restic) on separate storage.
Who gets in
- Personal accounts with two-factor sign-in by authenticator app or passkey; the owner can make it mandatory for the whole company.
- Roles: owner, deputy, accounting, sales, staff. Staff see only their own work.
- EaseAcc support sees your invoices, receipts or bank data only when you grant a time-limited access. Every access is logged and you get an email.
Isolation and immutability
- Every company is separated from all others in the database by row-level security, even if the application had a bug.
- Issued invoices and recorded payments are locked against changes in the database itself; corrections go through cancellation only. Files carry their SHA-256 checksum.
- An audit log records who did what and when. It can only be appended, never changed.
Backup and recovery
- Daily backup of database and files, kept in tiers for up to seven years, plus a backup before every update.
- Weekly automatic restore test and hourly self-check of the server with email alerts.
- You can export all your data at any time; after the contract ends you get an archive with checksums.
How we work
- Every version is tested automatically before release, including tenant isolation and the database locks; only the tested image is deployed.
- Only the web server and the key-based remote access are reachable from outside; security updates are applied automatically.
- The application uses a restricted database role; containers run read-only with privileges dropped.
Bank and integrations
- The direct bank connection (currently only for selected companies) is read-only: through Enable Banking, an account information service licensed in the EU, EaseAcc fetches transactions and balances. It cannot move money. You enter your banking credentials only at your bank.
- Keys for the bank connection are stored encrypted (AES-256-GCM) and bound to your company; API keys are stored only as a hash. We use no AI services ourselves; an assistant you connect is your choice.
- Receipts by email are accepted only from your team with a verified sender, and every attachment is scanned for viruses. Emails we send are not tracked for opens or clicks; error logs contain no IP addresses.
Report a vulnerability
Found a security issue? Please report it confidentially to security@easeacc.com or through the contact form. We reply within two working days and credit you if you wish. For security researchers the details per RFC 9116 are at /.well-known/security.txt.
The complete technical and organisational measures are an annex to the data processing agreement; the service providers we use are listed under Subprocessors. Data processing agreement · Subprocessors