Your receipts stay in the EU, are encrypted in transit, and are kept separate from other accounts. Public scan grades, including CryptCheck A+, are shown on this page—not a certificate.
Last updated: 24 October 2026
Encryption
Sensitive fields and receipt files are encrypted before storage, each account with its own key—so a disk or backup holds ciphertext, not readable content.
Three layers with their own keys. The master key wraps each account's data key, and that key wraps each file key.Full note
Even if someone removed a server disk or kept an old backup, they could not read your receipts or sensitive fields without your account's data key and the service master key. Receipt files and the personal and financial fields are encrypted in the application with AES-256-GCM before they are stored. Each account has its own data key; each receipt file has its own key wrapped by that account key. The account key is wrapped by a master key kept outside the database and source code (not derived from your password). Passwords are Argon2id hashes only. Database connections use TLS. Object storage in Paris holds sealed ciphertext. New files use the VIENC2 format.
Two-factor sign-in
You can turn on an authenticator app (TOTP, a code from your phone) and one-time recovery codes. Admin and staff accounts must use one.
Full note
Any account can turn on an authenticator app (TOTP) and gets one-time recovery codes. An email code is available as an optional second step and is not accepted once an authenticator is on. Administrator and staff accounts must enrol an authenticator before they can open the admin area; the invitation for a new staff member includes that step.
Account protection
Failed sign-ins are slowed down, password reset uses a one-time link, and changing your email needs confirmation.
Full note
Passwords must be at least 12 characters long and are checked against a list of common passwords. Repeated failed sign-ins lock the account for a while. Rate limits are shared by all servers through the database; for sign-in, codes, registration, and password reset, requests are refused if that check cannot run. A forgotten password is reset with a one-time link that expires after 60 minutes; using it signs out every session. Our staff can send you a reset link but never see the link or your password. Changing your email address needs your password and a code sent to the new address, and both the old and the new address are notified afterwards. New sign-ups confirm their email address with a code.
Separation between accounts
Row-level security in PostgreSQL (a database rule so one customer cannot read another's rows) backs up the checks in the app.
Full note
Every request is limited to the accounts it belongs to. On top of the checks in the application, PostgreSQL row-level security policies limit each query to the records of those accounts, as a second line of defence inside the database itself. Our staff cannot open your receipts or tax records unless you grant time-limited support access, and every use of that access is logged.
Browser and connection
HTTPS only. Browsers are told to stay on HTTPS (HSTS). The sign-in cookie is hidden from page scripts (HttpOnly) and sent only over HTTPS (Secure). A change needs a matching token (CSRF). A content security policy limits what each page can load.
Full note
The site and the API are served only over HTTPS. They send HSTS (Strict-Transport-Security), which tells browsers to stay on HTTPS, including subdomains and the preload flag. vectorinvoice.lt is on the browser HSTS preload list. The session is kept in HttpOnly, Secure, SameSite=Strict cookies, not in browser storage: page scripts cannot read the session cookie, and it is sent only over HTTPS. Every request that changes data must carry a CSRF token (a matching value, so another site cannot submit the change) that matches the session. Pages send a content security policy (a rule for what the page may load) with a fresh nonce (a one-time value) on each request and cannot be framed by other sites.
Audit log
Append-only log: each row keeps the action and a short note of what changed, not supplier names or receipt amounts. A plan price can appear.
Full note
The audit log is append-only: the database rejects updates and deletes. Each row stores the action, what was touched, and a sanitised JSON diff—mostly field names, status codes, and counts, not supplier names, email addresses, or receipt amounts (some operational figures such as plan prices may appear). Sign-ins, failed sign-ins, downloads of originals and exports, and support access are logged.
Export and erasure
After account deletion, copies left in backups can no longer be read—the account data key is destroyed. In Settings you can download your data while signed in, or delete files, records, or the whole account. Each deletion asks for your password and a one-time email code.
Full note
After deletion, any copies left in backups can no longer be read, because the account's data key is destroyed. In Settings you can download your data while you are signed in. Deleting stored files, deleting stored records, or deleting the account asks for your password and a one-time code sent to your email. Live receipt files are removed from storage in Paris. Provider backups are not erased on command; anything still encrypted with your destroyed key stays unreadable. A reduced accounting row (period, number, date, direction, and amounts, without names or files) may be kept for a configurable retention period. Receipt file copies are kept for 2 years from the document date—export what you still need for longer.
Independent checks
These rows are snapshots from the dates shown. Each link opens the same public scanner so you can run the check again.
Grades are snapshots from those dates. Scores can change. They are not certificates or guarantees.
The site, database, and receipt files stay at Scaleway in Paris (EU).
Receipt files and the sensitive fields listed on this page use your account's data key (AES-256-GCM). Connections use TLS only.
Those files and fields are stored as ciphertext on disk and in object storage—not readable without your account key.
Your documents are not used to train AI models. We have not asked Mistral for Zero Data Retention (keeping no copy of a request), so Mistral may keep a request for a limited time under its own terms.
No tracking cookies, no analytics, no advertising.
Where the service runsScaleway, Paris (EU), for the site, database, and receipt files. Receipts are read in the EU. Paid-plan payments go to Stripe, which may process them outside the EU. Documents are not used to train AI models.
The website, the API, the PostgreSQL database, and the receipt files run at Scaleway in the Paris region (France, EU). Account encryption keys are held by the application there, outside the database and the source code. Receipts are read through Mistral's EU endpoint. The application refuses other Mistral hosts and refuses any training purpose. Training on API calls is switched off in the Mistral account (confirmed on 17 October 2026). Zero Data Retention has not been requested. Payment data is processed by Stripe, which may transfer it outside the EU, including to the United States and India, under the safeguards described in its privacy policy. Card details are entered on Stripe's page. Receipts and bookkeeping content are not sent to Stripe.
What stays readable in the databaseThe personal and financial fields on this page, and receipt files, are encrypted. Date, period, status, and currency stay readable for lists, deadlines, and billing.
The personal and financial fields listed on this page, and receipt files, are encrypted. Receipt date, period, status, and currency stay readable, so the app can sort lists, remind you of deadlines, and handle billing. Those readable details are not the receipt's names, amounts, or file.
Encrypted fieldsDates, statuses, and currency codes are not encrypted.
Account
email, name
Business profile
legal name, VAT code, company code, address, IBAN
Receipts
supplier name, supplier VAT and registration number, invoice number, net, VAT and gross amounts, VAT lines, extracted data, notes, custom category, team comment, journal account, file names
journal entries (document number, description, amount); bank lines (description, amount); known suppliers (name, VAT code, registration code); FR0600 amounts (fields 29, 30, 31, and 36); generated tax XML
Certificates
file names, passwords
Team invites
email
Other services the application usesScaleway (hosting and outgoing email), Hostinger (domain and mailboxes), Mistral in the EU, Stripe for paid plans, VIES, and the Lithuanian open-data lookup.
Scaleway (Paris, EU): the website, the API, the database, encrypted receipt files (object storage), logs, and outgoing email. Account encryption keys are held by the application on those hosts.
Hostinger: the domain vectorinvoice.lt, its DNS, and the mailboxes that receive email sent to us, such as support requests.
Mistral, only through its EU endpoint (api.eu.mistral.ai), to read a receipt, turn one sentence into a draft, or transcribe a short recording. The code refuses other Mistral hosts and the files and agents APIs. Training on API data is switched off in the Mistral account (confirmed on 17 October 2026). Zero Data Retention has not been requested.
Stripe Payments Europe, Limited (Dublin, Ireland): checkout and subscriptions for paid plans. The name, email, billing address, and payment details go to Stripe. Card numbers are entered on Stripe's page and are not stored here. Stripe may transfer payment details outside the EU.
The European Commission VIES service, when a VAT number is looked up and the lookup is not switched off.
The open data set at get.data.gov.lt, for a company code, under the same lookup switch.
Security testingThe code is checked automatically on every change and reviewed in internal penetration tests. No external audit or certificate is claimed.
Every change runs automated tests, a security self-check, static analysis, dependency audits, and a scan for secrets in the code. In October 2026 we ran internal penetration tests of the application (a code review plus careful checks of the live site), and the findings were followed up in the code. These are our own tests, not a certified third-party audit.
Reporting a vulnerabilityEmail support@vectorinvoice.lt. Our security.txt lists the same contact.
If you think you have found a security problem, email support@vectorinvoice.lt with a short description and the steps to reproduce it. Please do not access other people's data, run load (DoS) tests, or publish details before we have had a chance to fix the issue. The contact is also published at /.well-known/security.txt.
What this page does not claimNo certificate and no external audit.
VectorInvoice holds no ISO 27001, SOC 2, or other security certification, and no external auditor has assessed it. The security tests mentioned above are internal. Zero Data Retention with Mistral has not been requested. The provider details are in the imprint (/legal#imprint).
Questions
Is the service hosted in the EU?
Yes. The website, the API, the database, and the receipt files run at Scaleway in Paris, France. Receipts are read through Mistral's EU endpoint.
Do I have to use an authenticator?
Not as a customer, but you can turn one on at any time in Settings. Keep the recovery codes somewhere safe. Administrator and staff accounts must use one. An email code does not replace an authenticator that is already on.
Are the receipt photos encrypted?
Yes. Each receipt file has its own key, wrapped by your account's data key, and is stored encrypted in object storage in Paris. The personal and financial fields are encrypted as well; dates, statuses, and currency codes are not. The data key is not derived from your password and is destroyed when the account is deleted. This is a description, not a certification.
Can I take my data out or close the account?
Yes. In Settings you can download your data, delete stored files, delete stored records, or delete the account. Each deletion asks for your password and a one-time code sent by email; the code is valid for 10 minutes and works once. Deleting the account deletes the files and records, signs you out everywhere, and destroys the account's data key, so encrypted copies, including those in backups, can no longer be opened. A reduced accounting row may be kept for a configurable retention period. Receipt file copies are kept for 2 years from the document date; export anything you want to keep longer.
Do you train a model on my invoices?
No. The application refuses any training purpose for customer content, and training on API calls is switched off in our Mistral account (confirmed on 17 October 2026). Receipts, sentences, and recordings go only to Mistral's EU endpoint, and only to handle your request. Zero Data Retention has not been requested, so Mistral may keep requests for a limited time under its own terms.
Can I get a data processing agreement?
Yes. The data processing agreement (DPA) is part of the Terms of Service and applies automatically. You can read and download it on the DPA page.
VectorInvoice