Security and law.
This page says what applies today. Where something is not settled yet, that is stated here as well and not in the small print.
- Where the data is
- The servers are at Hetzner in Germany. Your receipts stay in your own cloud, the recognised data sits on that server, and recognition runs at AWS in Frankfurt.
- Which recognition reads your receipts
- Recognition runs through AWS Bedrock in the Frankfurt region (eu-central-1). Anthropic and OpenAI get no access to your receipts.
- What is stored on my side
- The fields that were read (supplier, date, amount, invoice number, currency), the processing state and the reference to the file in your cloud. Receipts whose recognition is uncertain are buffered on my side until you have decided, and deleted afterwards.
- Access to your mailbox
- I only read your mailbox. I write nothing there and delete nothing. Access runs through an app password that allows reading only, or through forwarding. You can revoke either one at your provider at any time.
- Data processing agreement
- The data processing agreement is part of the subscription (version 2026-08-31) and is concluded when the account is created.
- Sign-in and second factor
- Signing in runs in two steps with an authenticator app. You receive the recovery codes during setup and see them exactly once.
- Professional secrecy under section 203 of the German Criminal Code
- Every person I engage is bound to confidentiality in text form before their first access. My sub-processors Hetzner and AWS are not separately bound under section 203: as a sole trader I currently do not obtain such a declaration from these providers. This note appears again during registration, and you decide in full knowledge of it.
- Cancellation, export and deletion
- During the trial you can cancel at any time free of charge, afterwards at the end of the current month, either through the button in your account or with an email to me (terms, section 6 (1) and (2)).
- On request, I keep your document data available for download for 30 days after the contract ends. Send me that request by email before the contract ends (terms, section 6 (4)). If you choose neither return nor deletion within 30 days after the contract ends, I delete all data belonging to your account (data processing agreement, section 9). It disappears from the daily backups after 14 days at the latest. Your receipt files are in your own cloud and stay there.
Anything left open?
Write to me. I answer myself. bela@abel-automation.de