Annual accounts software and the GDPR
Annual accounts software processes financial data and personal data. With this checklist you test whether a supplier does so securely and in line with the GDPR.
What the GDPR asks of annual accounts software
Annual accounts software processes personal data as well as figures, such as the names of directors and shareholders. If the supplier processes personal data on your behalf, it is a processor and you conclude a data processing agreement under article 28 GDPR. Assess per service which data the supplier processes. Also ask for two-step verification, roles and an audit trail.
You remain responsible yourself for the choice of supplier, and you look at where the data is and who sees it. The GDPR asks for appropriate technical and organisational measures (article 32 GDPR). For financial data that means in practice: encryption, restricted access and auditability.
Which personal data is in annual accounts
- Names of directors and supervisory directors, who sign the annual accounts.
- Shareholders and their interest, for example in the adoption resolution.
- The remuneration of directors, if you must state it art. 2:383 DCC.
- Loans to or from the DGA (director-major shareholder), current account positions and security.
- For small organisations: amounts that can be traced to one person, such as the wage costs of one employee.
This data is not special category data under the GDPR, but it is sensitive. Only the people who work with it should see it.
Checklist for the supplier
| Question | Why |
|---|---|
| Is there a data processing agreement? | Mandatory insofar as the supplier processes personal data on your behalf (article 28 GDPR) |
| Where are the database and the files? | Within the EEA no extra requirements apply to transfers |
| Which sub-processors are there, and where do they process? | Think of hosting, e-mail, payments and AI services |
| Does data leave the EEA, for example for AI? | Safeguards for the transfer are then needed (chapter V GDPR) |
| Is your data used to train AI models? | Ask in writing; the terms of the AI provider determine the answer |
| Is two-step verification mandatory? | A password alone is not enough for financial data |
| Are there roles and an audit trail? | That way you see who changed and approved what |
| Can you export everything, and how long is it kept? | You must keep the documents for seven years art. 2:10(3) DCC |
| How does the supplier report a data breach? | A processor reports a data breach to you as soon as possible. If notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is mandatory, you as controller make it if possible within 72 hours after you discovered the breach (article 33 GDPR) |
AI functions and data outside the EU
Much annual accounts software uses language models for texts and proposals. Those models often run at a US provider. So ask which data goes to the model, where it is processed, how long it is kept and whether it is used for training. More on this in AI and the GDPR.
How Jaarrekening.io handles this
- The primary database and document storage run in a European region of Supabase (AWS EU).
- For selected AI functions, the necessary data goes to Anthropic's commercial API. Anthropic does not use API data for model training by default, can process requests in several regions and stores API input and output in the United States by default.
- Other sub-processors include Vercel (delivery of the website), Stripe (payments) and Resend (e-mail). The full overview is on the security page.
- Connections are encrypted with TLS; storage is encrypted by the infrastructure.
- Two-step verification is mandatory to work in the app.
- Roles: administrator, preparer, reviewer and approver. The database enforces per workspace who may see what (row-level security).
- Selected actions, such as login attempts, data changes, permissions and exports, go into an audit trail.
- The data processing agreement and the privacy statement are online. Jaarrekening.io is offered by MLR Ventures GmbH in Berlin.
If your own policy does not allow processing outside the EEA, do not use the AI functions. That advice is also on the security page.
More about annual accounts software
Updated 30 October 2026. Jaarrekening.io prices exclude VAT.
Frequently asked questions
Is a data processing agreement mandatory for annual accounts software?
Yes, insofar as the supplier processes personal data on your behalf. With annual accounts software that is usually the case, because the names of directors and shareholders are in the file. Article 28 of the GDPR prescribes what the agreement must contain.
May my annual accounts be on servers outside the EU?
That is allowed if there are appropriate safeguards for the transfer, such as an adequacy decision or standard contractual clauses. Many organisations prefer storage in the EEA.
Does Jaarrekening.io use my figures to train AI?
Jaarrekening.io uses Anthropic's commercial API. Anthropic does not use input and output of that API for model training by default. AI requests can, however, be processed outside the EU.
How long must I keep the annual accounts and administration?
Seven years, under art. 2:10(3) DCC and art. 52 of the Dutch General State Taxes Act (Algemene wet inzake rijksbelastingen). Make sure you can export your documents from the software, so that this period does not depend on a supplier.
Read more
Preparing Dutch annual accounts?
Your first set of annual accounts is free, for every size class. Create an account and prepare the annual accounts of your Dutch company under Title 9 of Book 2 of the Dutch Civil Code.
Get started