Security and your data

On servers we operate at Hetzner, in Falkenstein, Germany. Bill and document records live in a single SQLite database; the original PDFs and images are stored as ordinary files on the same machine, under a separate tree per organisation. Your organisation's records are readable only through your organisation's membership: another customer's account cannot see them.

The database is snapshotted twice a day, at 03:00 and 15:00 UTC, integrity-checked, compressed and kept for 30 days, together with a daily snapshot of the stored files. Those snapshots are pushed twice a day to a Hetzner Storage Box in Helsinki, Finland, over SSH, reachable only from our server. A record you delete therefore persists in backups for up to 30 days before ageing out.

We make no claim here about encryption at rest. The privacy policy does not make one, and this page does not go past it.

This list is kept as a manifest of call sites in the code, beside the privacy policy, and it is meant to be complete. One line each here; the policy has the detail.

• Your mail provider. Google's Gmail API or Microsoft Graph, to fetch mail and to exchange OAuth tokens when a mailbox is connected or a token is refreshed. Reads only.
• Sign in with Google. A separate, much smaller exchange, asking Google only who is at the keyboard. No lasting Google credential is requested or kept.
• The AI provider that reads documents. Anthropic by default; an organisation's owner may instead select OpenAI, and those two are the only choices a customer organisation has.
• Xero, if an organisation connects it. A draft supplier invoice with the stored document attached. Nothing is sent until an owner connects it.
• Exchange-rate lookups. api.frankfurter.dev, with open.er-api.com as a fallback. Both receive a date and a pair of currency codes and nothing else.
• Place lookups for the map. Google's Geocoding API, to turn a place named on a receipt into a coordinate. It is asked once per place, the answer is cached, and it is never sent a phone's own location.
• Map tiles. The Map screen draws a Google map, so the browser or the phone loads map imagery from Google while that screen is open.
• Apple's geocoding service, from the phone. A coordinate, turned into the street a receipt was captured on.
• Images embedded in an email, when one is rendered to PDF. On by default, so the saved copy looks like the original, and it can be turned off in Settings.
• Serbian fiscal receipts. A receipt carrying a Serbian tax QR code is verified against the Serbian tax authority's own service, which is what the code is for. Serbia only.
• Unsubscribe requests. Only the senders you select and confirm, sent to the address that sender printed in its own headers.
• Off-site backups. To the Storage Box described above.
• The web certificate. Obtained and renewed from Let's Encrypt. No account data is involved.
• A webfont. The application's own stylesheet loads a font from Google Fonts, so opening a page of the web interface asks Google for it. We are removing it. This site never loads it.

There is no analytics, no tracking, no advertising, no crash or error reporting, and no outbound email capability of any kind.

Two services will join this list before public sign-up, because the service cannot open without them: something to send email, and a payment processor. Neither exists yet.

Every document is read by a third-party AI model. What is sent is the material being classified, and only to the one provider that organisation has configured: Anthropic by default, or OpenAI if its owner selects it.

Kivolio trains no model of its own, and does not have one. What a provider does with what it receives is governed by that provider's own terms, and we will not overstate them: a no-training position confirmed in writing is not yet in place, and obtaining one — or dropping any provider that cannot back it — is something we have committed to before public sign-up opens. Data obtained from a connected Google account is covered by the stricter, unconditional undertaking quoted above.

Where the key lives

Kivolio's own AI key lives in the server's environment, never in a database row, and it never reaches a device. The iPhone app classifies through a metered proxy on our server, and the phone's configuration endpoint hands out no key at all — it does not even read one.

Or set your organisation's own key, and the reading runs on your contract, your bill and your data-processing relationship. The meter still counts it.

What exists today: a CSV export of every bill row, from the Storage panel in Settings; per-project handover packs for your accountant, which bundle the bills in a date range with their documents, images re-encoded to JPEG and capped at 2000 pixels; a download button on every individual bill and document, which gives you the original file; and expense reports as CSV per project.

What does not exist yet: a single whole-account export containing every bill, every document and every stored file in one archive, and deleting a whole account or organisation in one action. Both are conditions of public launch and neither is built. Until they are, write to privacy@kivolio.app and we will do it by hand.

Individual bills and documents can be deleted inside the application at any time, and removing a mail account deletes that account's stored records and files along with its authorisation. Deleted data ages out of the backups within 30 days.