What is in place today: where the service runs, how your data is encrypted, how accounts are protected, and what this page does not claim. A description, not a certificate or an audit report.
Last updated: 22 October 2026
Encryption
Receipt files and the personal and financial fields are encrypted with AES-256-GCM. Each account has its own data key.
Three layers with their own keys. The master key wraps each account's data key, and that key wraps each file key.Full note
Receipt files and the personal and financial fields are encrypted in the application with AES-256-GCM before they are stored. Each account has its own data key. Each receipt file has its own key, wrapped by that account key. The account key is wrapped by a master key that is kept outside the database and the source code. The account key is not derived from your password: changing or resetting the password does not lock your data, and deleting the account destroys the key. Passwords are stored only as Argon2id hashes. Connections to the database use TLS.
Two-factor sign-in
An authenticator app (TOTP) and recovery codes are available to every account. Administrator and staff accounts must use one.
Full note
Any account can turn on an authenticator app (TOTP) and gets one-time recovery codes. An email code is available as an optional second step and is not accepted once an authenticator is on. Administrator and staff accounts must enrol an authenticator before they can open the admin area; the invitation for a new staff member includes that step.
Account protection
Sign-in attempts are limited, a password is reset with a one-time link, and email changes are confirmed.
Full note
Passwords must be at least 12 characters long and are checked against a list of common passwords. Repeated failed sign-ins lock the account for a while. Rate limits are shared by all servers through the database; for sign-in, codes, registration, and password reset, requests are refused if that check cannot run. A forgotten password is reset with a one-time link that expires after 60 minutes; using it signs out every session. Our staff can send you a reset link but never see the link or your password. Changing your email address needs your password and a code sent to the new address, and both the old and the new address are notified afterwards. New sign-ups confirm their email address with a code.
Separation between accounts
PostgreSQL row-level security keeps each customer's records apart, on top of the checks in the application.
Full note
Every request is limited to the accounts it belongs to. On top of the checks in the application, PostgreSQL row-level security policies limit each query to the records of those accounts, as a second line of defence inside the database itself. Our staff cannot open your receipts or tax records unless you grant time-limited support access, and every use of that access is logged.
Browser and connection
HTTPS with HSTS, HttpOnly and Secure session cookies, CSRF tokens, and a strict content security policy.
Full note
The site and the API are served only over HTTPS and send HSTS (Strict-Transport-Security, including subdomains, without the preload flag). The session is kept in HttpOnly, Secure, SameSite=Strict cookies, not in browser storage. Every request that changes data must carry a CSRF token that matches the session. Pages send a content security policy with a nonce per request and cannot be framed by other sites.
Audit log
The log is append-only. A row keeps the action and a count, not the email or the amount.
Full note
The audit log is append-only: the database rejects updates and deletes. A row records the action and, where needed, a count or a field name, but not your email, amounts, or the text of a comment. Sign-ins, failed sign-ins, downloads of originals and exports, and support access are logged.
Export and erasure
In Settings you can export your data or delete files, records, or the whole account. Each deletion asks for your password and a one-time email code.
Full note
A compressed copy of each receipt file is kept for 2 years from the document date; the extracted fields and the journal stay after that. Keeping records for as long as the law requires is your responsibility, so export what you still need. In Settings you can download your data, delete stored files, delete stored records, or delete the account. Each deletion asks for your password again and a one-time code sent to your email address. Receipt files are deleted from storage, including the object storage in Paris. Deleting the account also destroys its data key, so encrypted fields and files left in a backup can no longer be opened. A reduced accounting row (period, number, date, direction, and amounts, without names or files) may be kept for a configurable retention period. Deletion does not remove provider backups directly.
Checks anyone can repeat
Two public scanners test this site from outside. The grades below are the last results we checked by hand. Open a link to run the test again.
Where the service runsScaleway, Paris (EU). The application processes your data in the EU and does not use it to train AI models.
The website, the API, the PostgreSQL database, the receipt file storage, and the encryption keys run at Scaleway in the Paris region (France, EU). Receipts are read through Mistral's EU endpoint. The application does not send customer data outside the EU and never uses it to train AI models: it refuses any training purpose, and training on API calls is switched off in the Mistral account.
What stays readable in the databaseDates, statuses, and currency codes stay readable. Names and amounts are encrypted.
Names, invoice numbers, amounts, VAT numbers, and the text read from a receipt are encrypted in the database. Sign-in uses a one-way index of the email, so the address is not stored in the clear. Dates, statuses, and currency codes stay readable so a period can be listed. Searching a name happens in the application after decryption, and only inside that account. After the account is deleted, a reduced retention row can keep a document number, amounts, a date, and a direction in the clear. It does not keep a name, an email address, or the file.
Encrypted fieldsDates, statuses, and currency codes are not encrypted.
Account
email, name
Business profile
legal name, VAT code, company code, address, IBAN
Receipts
supplier name, supplier VAT and registration number, invoice number, net, VAT and gross amounts, VAT lines, extracted data, notes, custom category, team comment, journal account, file names
journal entries (document number, description, amount); bank lines (description, amount); known suppliers (name, VAT code, registration code); FR0600 amounts (fields 29, 30, 31, and 36); generated tax XML
Certificates
file names, passwords
Team invites
email
Other services the application usesScaleway (hosting and email), Hostinger (domain and mailboxes), Mistral in the EU, VIES, and the Lithuanian open-data lookup.
Scaleway (Paris, EU): the website, the API, the database, encrypted receipt files (object storage), keys and secrets, logs, and outgoing email.
Hostinger: the domain vectorinvoice.lt, its DNS, and the mailboxes that receive email sent to us, such as support requests.
Mistral, only through its EU endpoint (api.eu.mistral.ai), to read a receipt, turn one sentence into a draft, or transcribe a short recording. The code refuses other Mistral hosts and the files and agents APIs. Training on API data is switched off in the Mistral account (confirmed on 17 October 2026). Zero Data Retention has not been requested.
The European Commission VIES service, when a VAT number is looked up and the lookup is not switched off.
The open data set at get.data.gov.lt, for a company code, under the same lookup switch.
Security testingThe code is checked automatically on every change and reviewed in internal penetration tests. No external audit or certificate is claimed.
Every change runs automated tests, a security self-check, static analysis, dependency audits, and a scan for secrets in the code. In October 2026 we ran internal penetration tests of the application (a code review plus careful checks of the live site), and the findings were followed up in the code. These are our own tests, not a certified third-party audit.
Reporting a vulnerabilityEmail support@vectorinvoice.lt. Our security.txt lists the same contact.
If you think you have found a security problem, email support@vectorinvoice.lt with a short description and the steps to reproduce it. Please do not access other people's data, run load (DoS) tests, or publish details before we have had a chance to fix the issue. The contact is also published at /.well-known/security.txt.
What this page does not claimNo certificate and no external audit.
VectorInvoice holds no ISO 27001, SOC 2, or other security certification, and no external auditor has assessed it. The security tests mentioned above are internal. Zero Data Retention with Mistral has not been requested. The provider details are in the imprint (/legal#imprint).
Questions
Is the service hosted in the EU?
Yes. The website, the API, the database, and the receipt files run at Scaleway in Paris, France. Receipts are read through Mistral's EU endpoint.
Do I have to use an authenticator?
Not as a customer, but you can turn one on at any time in Settings. Keep the recovery codes somewhere safe. Administrator and staff accounts must use one. An email code does not replace an authenticator that is already on.
Are the receipt photos encrypted?
Yes. Each receipt file has its own key, wrapped by your account's data key, and is stored encrypted in object storage in Paris. The personal and financial fields are encrypted as well; dates, statuses, and currency codes are not. The data key is not derived from your password and is destroyed when the account is deleted. This is a description, not a certification.
Can I take my data out or close the account?
Yes. In Settings you can download your data, delete stored files, delete stored records, or delete the account. Each deletion asks for your password and a one-time code sent by email; the code is valid for 10 minutes and works once. Deleting the account deletes the files and records, signs you out everywhere, and destroys the account's data key, so encrypted copies, including those in backups, can no longer be opened. A reduced accounting row may be kept for a configurable retention period. Receipt file copies are kept for 2 years from the document date; export anything you want to keep longer.
Do you train a model on my invoices?
No. The application refuses any training purpose for customer content, and training on API calls is switched off in our Mistral account (confirmed on 17 October 2026). Receipts, sentences, and recordings go only to Mistral's EU endpoint, and only to handle your request. Zero Data Retention has not been requested, so Mistral may keep requests for a limited time under its own terms.
Can I get a data processing agreement?
Yes. The data processing agreement (DPA) is part of the Terms of Service and applies automatically. You can read and download it on the DPA page.
Data processing agreement
The data processing agreement (DPA) is part of the Terms of Service and applies automatically. You can read and download it on the DPA page.
No ISO 27001 or SOC 2 certificate, external audit report, or hosting badge is claimed. This page is a description, not an attestation.
VectorInvoice