Security at Finpilo

Finpilo processes your invoices and the financial data in them. This page describes how we protect that data.

Hosting and data location

• Finpilo runs on Microsoft Azure.
• All your data is stored and processed in the European Union. Your documents, extracted data and settings are stored in Azure data centres in Poland.

Encryption

• In transit: all connections to Finpilo are encrypted with TLS 1.2 or newer. Unencrypted connections are refused.
• At rest: documents, the database and backups are encrypted with AES-256.

Backups

• The database is backed up automatically. Backups are encrypted and kept for 7 days.

Access to your data

• Each customer works in its own workspace. Every request is checked against the user's access to that workspace, so no customer can see another customer's data.
• Roles and permissions in your workspace decide who can see, change, approve or delete documents and settings.
• Every change to a document is recorded with who made it and when.
• Sign-in is handled by Auth0, a dedicated identity provider. Finpilo never stores your password.

Application security

• Every change to Finpilo is tested automatically before release, and the code is scanned for exposed keys and passwords.
• Errors and failed requests are monitored after every release.

AI and your documents

• Documents are read by AI only to extract their data for you.
• Your documents and the data extracted from them are never used to train AI models.

Incident response

If a personal data breach affects your data, we notify you without undue delay, and where possible within 72 hours of becoming aware of it.

Your data, your control

• You can export your data at any time.
• When your workspace ends, it stays available read-only for 60 days and is then deleted.
• Our Terms of Service set out these commitments, and our Privacy Policy lists the service providers we use.

Report a security issue

If you find a security issue or have a security question, write to help@finpilo.com.