Privacy

Invoices are commercially sensitive. Documents are processed in memory and discarded after validation. We do not permanently store invoice XML/JSON, invoice numbers, names, addresses, VAT numbers, descriptions, totals, bank details, or other invoice values.

Phase 1 capability-assessment answers and reports are never persisted. We retain only invoice-validation metadata and findings—such as a random result ID, format, byte size, ruleset versions, score, rule/message codes and duration—for 90 days. Source IP addresses are stored only as keyed HMACs.