M Mandavo
Funktionen Preise Sicherheit Anmelden Loslegen
SECURITY POLICY Version v2.3 Reviewed 2026-05-20 0 incidents reportable this year

Boring security,
on purpose.

Tax firms already follow strict rules about retention, custody and audit. We built the product the same way: predictable defaults, written-down behaviour, and a paper trail you can hand to a regulator without flinching.

1
Hosting region
European Union, single tenant DB
3
Sub-processors
Down from 9 in our first quarter
72 hours
Incident SLA
Article 33 / NIS2 notification clock
0
Reportable incidents
Year to date, register link below
§ 02   Principles

Eight things we actually do.

Each principle is paired with a deliberate non-feature - the thing we chose not to do. Both halves matter. A security claim without a counterweight is marketing copy.

  1. 01 / 08
    Custody

    Sensitive identifiers are encrypted at rest.

    What we do

    VAT numbers, tax numbers and client identifier values are encrypted using Laravel's authenticated encryption. The application sees plaintext; the database row never does.

    What we do not do

    We do not ship a single master key, store keys in source, or rely on disk encryption alone as the boundary.

  2. 02 / 08
    Isolation

    Every firm queries its own slice of the database.

    What we do

    Every model that holds firm data carries a global firm scope. Cross-tenant queries require an explicit opt-out reserved for system jobs.

    What we do not do

    User requests cannot cross tenants. There is no "switch firm" superuser path that bypasses the scope - not even for support.

  3. 03 / 08
    Audit

    Every meaningful action lands in an append-only log.

    What we do

    Document approvals, period closings, retention purges, exports and sick-leave decisions produce an audit-log row with actor, IP, user-agent and structured properties.

    What we do not do

    The log table is append-only - the application has no UPDATE or DELETE path. Edits create a new row referencing the old one.

  4. 04 / 08
    Retention

    Data leaves when the law says it can.

    What we do

    Per-firm retention windows you can shape by document category and country. A nightly purger deletes or anonymises documents past their window.

    What we do not do

    Documents under an active legal hold are exempt and stay until the hold is lifted - we never delete what a tax authority asked you to keep.

  5. 05 / 08
    Zugriff

    Sensitive categories default to closed.

    What we do

    Narrow categories like payroll can be granted to named users. Once any restrictive grant exists, default-open access for that category flips to default-closed.

    What we do not do

    There is no "everyone can see everything" mode. An admin role does not bypass category-level grants without an explicit override that is itself logged.

  6. 06 / 08
    Compliance

    GDPR Articles 15 and 17 are built in, not bolted on.

    What we do

    Data-export and erasure workflows ship in the product. Sick-leave records hold administrative data only - never a diagnosis. Held documents survive erasure but are detached from the user.

    What we do not do

    We do not require a support ticket to exercise data rights. The workflow is the same the regulator audits.

  7. 07 / 08
    Identity

    Sign-ins are tracked, failed attempts more so.

    What we do

    Every sign-in, failed attempt, logout and password reset goes to a queryable login-events table. Anomalies surface in the security inbox.

    What we do not do

    We do not silently retry credentials, suggest weak passwords, or e-mail you a copy of one. MFA is the path, not the exception.

  8. 08 / 08
    Exports

    What leaves the system is tamper-evident.

    What we do

    Every export package records the SHA-256 of the bundle at write time. Auditors re-hash the file later and confirm it has not been altered since hand-off.

    What we do not do

    Exports are not silently regenerated when re-downloaded - the hash you got is the hash that exists, forever.

§ 03   Non-collection

What we never store.

A privacy posture is mostly a list of what you said no to. Ours is short and deliberate.

  • A. Medical diagnoses or doctor's-note contents
    Sick-leave entries record dates and an administrative status. The note itself stays with the employee.
  • B. Biometric verification by default
    No selfie checks, no fingerprint walls. A firm can opt in, with disclosure.
  • C. GPS or device-level location
    IP is logged for security events. Continuous tracking is not a product we offer.
  • D. Behavioural analytics or session replay
    No heatmaps, no third-party recorders watching your team work.
  • E. Client data used for model training
    Your documents are yours. They are not a training corpus for ours or anyone else's models.
§ 04   Sub-processors

Where data lives.

A short, deliberate list. Each partner is contractually committed to GDPR-aligned processing and lives - where it can - inside the EU.

Service Purpose Region Certification
EU-Rechenzentren
Application database & file storage
Hosts all firm data, encrypted at rest, daily backups retained for 30 days. EU-CENTRAL-1 ISO 27001
Stripe
Subscription billing
Processes payment cards. Card data never touches our servers. EU / US PCI-DSS L1
Postmark
Transactional email & inbound intake
Routes inbound documents via per-client tokens; sends notification email. EU SOC 2 II

Last verified 2026-05-20  ·  Request DPA & full sub-processor list

§ 05   Incident response

The 72-hour clock.

Article 33 of GDPR and the NIS2 directive give us 72 hours from awareness to a regulator-facing notification. Our incident register tracks each stop on that clock.

Request the register
T + 00h
Detected
Alert fires; on-call engineer paged.
T + 04h
Triaged
Scope assessed; affected firms identified.
T + 24h
Customers notified
Affected firms emailed; status page updated.
T + 72h
Regulator filed
DPA notification submitted under Art. 33.
§ 06   Kontakt

Talk to a human.

Security review for an enterprise plan, DPA negotiation, a vulnerability report, or the full sub-processor list - the same address reaches the same person.

[email protected]
First response   < 24h business
PGP fingerprint
5C9F A3D2 7E14 B83A F021   6BDE 44C8 9012 EE3F A7B6