Jaarrekening.io

Security & Privacy

Your financial data deserves careful protection. Here you can read which measures the application actually applies and which external services may process data.

The key points at a glance

  • Data storage: the primary application database and document storage run in a European Supabase region; AI processing may take place internationally.
  • Encryption: encrypted transport (TLS) and storage encrypted by the infrastructure.
  • Data isolation: strict separation per organisation at database level (row-level security).
  • AI training: by default, Anthropic does not use API input and output for model training.
  • Data deletion: on request, subject to statutory and technical retention periods.

The certifications mentioned are those of the suppliers: a SOC 2 Type II report from Supabase and ISO/IEC 27001 for the AWS data centres.

What this page covers

Where data is stored, how it is encrypted and separated from other customers, who has access (the roles Admin, Preparer, Reviewer, Approver and External contributor), how data is protected during AI processing, what happens when the contract ends, which sub-processors may process data, which standards the product supports and which rights you have under the GDPR.

Sub-processors and other recipients, depending on the feature enabled: Supabase (AWS EU) for database, storage and authentication, Vercel for web hosting and as a relay for the bank link, Anthropic for AI (not the payroll records themselves), Stripe for payments, Resend for e-mail, Google Workspace for the info@jaarrekening.io mailbox, Sentry (EU) for error reports and Google Fonts for the typeface; Google Analytics and Tag Manager only after consent; Ponto (Ibanity) if you link a bank account, the PDOK Locatieserver for addresses, VIES for VAT numbers and Have I Been Pwned for the password check; optionally Cloudflare Turnstile, KVK, Company.info and Perplexity, bookkeeping providers you link and services such as Mollie and webhooks. The app does not send any returns to the Dutch Tax Administration.

Jaarrekening.io is not a long-term archive: you export records that must be retained by law yourself. The full explanation is on this page. You can report a vulnerability via Report a vulnerability.