Skip to content

Security and data protection

What happens to your invoice data

Invoices contain data of your customers and suppliers. Here you will find in one place where this data is stored, who processes it on our behalf, how invoices are checked and what happens when you cancel or delete your account.

Hosting and sub-processors

Your invoice data is processed in accordance with the GDPR. Invoices are stored in our database; generated files (XML, PDF) and attachments are stored in a storage area that is not publicly accessible. Only your account has access to them.

The following service providers process data on our behalf:

  • STRATO GmbH (Berlin): server hosting – application, database, files and backups – and sending of e-mails. A data processing agreement pursuant to Art. 28 GDPR exists with STRATO.
  • Sentry (Functional Software, Inc.): error monitoring in the EU data region. Invoice contents are not transferred to Sentry; recognisable identifiers (e-mail, IBAN) as well as tokens, passwords and cookies are masked before sending.

Stripe handles the payment of paid plans and only processes your own billing data, no invoice data. Web analytics and conversion tracking only run on the website and only with your consent in the cookie banner. Invoice data is not passed on to AI services.

Data processing agreement and technical and organisational measures

Where your invoices contain personal data of third parties, we process it on your behalf as a processor (Art. 28 GDPR). The data processing agreement is part of the terms and conditions and is concluded with them; a separate signature is not required.

Checking e-invoices

Checked with the KoSIT validator (official XRechnung configuration), Mustang and the EN 16931 Schematron. The validation runs on our own server; uploaded files are not passed on to third parties for validation and are not stored unless you import them into the invoice management.

Export, cancellation and account deletion

  • Export: In the user area you can download all your invoices as one ZIP file – the stored original files of imports and the most recently generated ZUGFeRD PDF and XRechnung XML files.
  • After cancellation: After the end of the term, the limits of the free plan apply to your account again. Your invoices remain in your account and you can still download them as PDF and XML.
  • Account deletion: You can delete your account in the user area as long as no subscription is running. Deleting the account immediately and permanently deletes your account data and all your invoices including their files (XML, PDF, attachments), payments, templates, API keys and validation logs. Excepted are the billing data of your subscription and cancellation and withdrawal declarations, which we have to keep for legal reasons. Deleted data remains in the daily backups on the server until they are deleted after 14 days.

No GoBD archive: E-Rechnungsfreund is not an audit-proof archive within the meaning of the GoBD. You are responsible for retaining your invoices in accordance with the statutory retention obligations – download everything you need to keep.

Who is behind it

The operator and contact details are in the legal notice. Legal notice · Contact

Frequently asked questions

Where is my data stored?

On the servers of our hosting provider STRATO GmbH. The application, the database, your invoice files and the validation of e-invoices run there. All sub-processors are listed in the privacy policy and in the data processing agreement.

Do I get a data processing agreement (DPA)?

Yes. Where your invoices contain personal data of your customers or suppliers, we process it on your behalf (Art. 28 GDPR). The data processing agreement is part of the terms and conditions and is concluded with them; it can be viewed on our website together with the technical and organisational measures and the list of sub-processors.

Is my data passed on to AI services?

No. The validation of e-invoices runs on our own server, and invoice data is not passed on to AI services.

How are my e-invoices checked?

With the KoSIT validator (official XRechnung configuration), Mustang and the EN 16931 Schematron, all on our own server. Uploaded files are not passed on to third parties for validation and are not stored unless you import them into the invoice management.

What happens to my data after cancellation or account deletion?

After the end of a paid plan, the limits of the free plan apply again; your invoices remain in your account and you can still download them, also all at once as a ZIP file. If you delete your account, all invoices including their files are permanently deleted; deleted data remains in the daily backups for up to 14 days.

Is E-Rechnungsfreund a GoBD archive?

No. E-Rechnungsfreund is not an audit-proof archive within the meaning of the GoBD. Keep your e-invoices additionally in your accounting or in a GoBD-compliant archive.