Security and data

Intended way of working

• The design is to process the invoice file in memory only, without saving it to a database, to disk or to logs. We will test this before launch.
• The design is not to keep the generated XML file after the session ends. We will test this before launch.
• No account is required, and the site does not collect registration data.
• The design does not send invoices or XML files to KSeF or to the Ministry of Finance.

What we have not checked yet

• That in-memory processing works exactly as we describe. Before launch we will check it with tests, including a test that no data reaches logs or permanent storage.
• That the external AI provider does not keep invoice data. The terms of that service and the data processing agreement are being prepared.
• That transmission security, access control and rate limits work in production. We have not yet run security tests.

Security by design: DevSecOps

We treat security as part of every code change, not as a final step. Each practice below has a status: LIVE means you can verify it today, PLANNED means it lands before the paid launch, and ROADMAP means a direction for later.

• LIVE. The source code lives in a private GitHub repository with full change history.
• LIVE. Secrets are kept out of the repository, and env files are listed in .gitignore.
• LIVE. Dependency vulnerability alerts (Dependabot) are enabled. Open alerts are reviewed before each release.
• LIVE. The beta is a static site plus one inactive sign-up endpoint; no invoice files are uploaded or stored.
• LIVE. The beta uses no third-party trackers or analytics.
• LIVE. The site runs over HTTPS by default on Cloudflare Pages.
• LIVE. The beta is excluded from search engine indexing (noindex).
• PLANNED. Security checks in the CI/CD pipeline: static application security testing (SAST), dependency and secret scanning, and infrastructure-as-code (IaC) scanning.
• PLANNED. A threat model for the invoice upload and processing pipeline.
• PLANNED. Controls against prompt injection in the AI extraction step, with output validation and user confirmation before any XML download.
• PLANNED. Dependency upgrades, including Next.js, after we review the open alerts.
• PLANNED. Logging without invoice content, confirmed by a test.
• PLANNED. An incident response runbook with emergency kill switches.
• PLANNED. An external penetration test before the paid launch.
• ROADMAP. SOC 2-style controls, a bug bounty programme, and a data protection audit led at DPO level.

What we do not claim yet: that we cover every cyber risk, that the beta has passed a penetration test or an independent audit, or that our dependencies are free of known vulnerabilities. The open alerts are under review.