Home / Security & data protection

Security & data protection

Three sentences, no adjectives: your invoice, client and deal data is encrypted in your browser before it leaves the device; production data is stored in the EU (Frankfurt); with the vault enabled we cannot read your financial data, and we say plainly below what we can read and what we cannot.

18 October 2026v1.0GDE Systems OÜ

Executive summary

Client-side encryption (AES-256-GCM, PBKDF2 600,000 iterations) is applied in the browser before sync; the encryption key never reaches our servers.
All production data lives in the EU (Frankfurt, eu-central-1). We do not transfer production data outside the EEA.
We publish every third party that can touch your data, with purpose, region and transfer basis — and we give 30 days' notice before adding one.
Security headers are enforced at the edge: HSTS (one year, includeSubDomains) and a Content-Security-Policy in enforcing mode with an allowlist; inline scripts are still covered by 'unsafe-inline' pending the hash migration.

Data flow: what leaves your browser, and to whom

Every arrow below is a real network destination. If a third party is not in this diagram, it does not receive your data.

Your browser What reaches it: Plaintext while you work; encrypted payload before sync
What never reaches it: —
Purpose: Key derivation (PBKDF2) and AES-256-GCM encryption happen here

Cloudflare (edge, WAF, Turnstile) What reaches it: IP address, request headers, bot-challenge signals for the contact form
What never reaches it: Decrypted invoice contents — the vault payload is opaque at the edge
Purpose: Delivery, DDoS protection, abuse prevention

Supabase (PostgreSQL, Frankfurt) What reaches it: Encrypted workspace blob, account e-mail, service metadata (timestamps, ids)
What never reaches it: Your encryption key, your recovery phrase
Purpose: Storage, authentication, row-level access rules

Resend What reaches it: E-mail address and the text of account e-mails (sign-up, password reset, invitations)
What never reaches it: Invoice, client or deal data
Purpose: Transactional e-mail delivery

Google (Gemini API) What reaches it: Only the company name or registry code you type into the optional company lookup
What never reaches it: Invoice, client, deal or contact data
Purpose: Optional AI company lookup; can be avoided entirely by searching the register directly

Your own OneDrive / Google Drive (optional) What reaches it: Documents you choose to store there
What never reaches it: Anything you did not explicitly upload
Purpose: Keeping documents in storage you already control

Encryption: what is encrypted, what is not

Data	State	Detail
Invoices, clients, deals, time entries, tags	Encrypted in the browser	AES-256-GCM with a key derived from your password (PBKDF2, 600,000 iterations). We store ciphertext.
Documents in the vault	Encrypted in the browser	Same envelope; the key is never sent to the server.
Transport	Encrypted in transit	TLS 1.2+ for every request. HSTS: max-age 1 year, includeSubDomains. CSP is enforced with an allowlist; hash-based script-src is the next step.
Account e-mail, workspace name, billing data	Not client-side encrypted	Required for authentication and support. Accessible to GDE Systems OÜ staff with least-privilege roles.
Service metadata (ids, timestamps, sizes)	Not client-side encrypted	Needed for sync, conflict resolution and audit log. Never contains invoice amounts or counterparty names.
Your password and recovery phrase	Never transmitted as plaintext to us	Only a derived value is used; we cannot recover the key if both are lost.

Access control

Roles: administrator, accountant, invoicer, viewer. Invitations are scoped to one workspace and can be revoked instantly.
Account security view: every device signed into your account is listed in Settings → Profile; you can end any session.
Two-factor authentication (TOTP authenticator app) can be enabled in Settings → Security and is then required at every sign-in; Google and Microsoft sign-in additionally delegate 2FA to your identity provider.
Least privilege internally: production access is limited to the founder account, and any support action that touches customer metadata is logged.
Public payment pages are isolated from authenticated app routes; no secret keys are shipped to the browser (enforced by a build-time secret check).

Infrastructure and regions

Component	Provider	Region	Notes
Database, authentication, edge functions	Supabase	EU — Frankfurt (eu-central-1)	Primary production store
CDN, WAF, bot protection, static delivery	Cloudflare	Global edge with EU data localisation options	Processes request metadata, not decrypted vault payloads
Transactional e-mail	Resend	EU/US processing under SCCs	Account and contact-form e-mails only
Optional AI company lookup	Google (Gemini API)	US processing under the EU-US Data Privacy Framework	Company name or registry code only; never invoice or contact data

Backups and recovery

What we promise

Weekly export reminder with a one-click full export (invoices, clients, deals, time entries) — your copy, not a support ticket.
Documented restore procedure: importing your own export rebuilds the workspace without contacting us.
Zero-knowledge vault is designed so that a database copy alone is useless without your key.

What we do not promise

We do not run a managed backup-and-restore service during the beta, and we do not promise a recovery time objective (RTO). Exporting your data stays your responsibility — we automate the reminder, not the obligation.
If you lose both your password and your 12-word recovery phrase, the encrypted data cannot be recovered by anyone, including us. That is the design, not an incident.

Recovery Kit

Your 12-word recovery phrase, written down and stored offline (not in the same password manager as the password).
A printed recovery card template with the fields to record: workspace name, e-mail, phrase, date, storage location.
A documented handover procedure for accountants: the phrase goes into the client's own safe or sealed envelope — never into a shared chat or e-mail.
Rotation rule: if a recovery card was ever photographed, shared or stored in cloud notes, treat it as compromised and re-encrypt the workspace.

Metrics: how our numbers are produced

Every figure published on the website is produced by the method below, on a monthly refresh, and is not published at all when the sample is smaller than 30 operations.

Published metric	Method	Privacy safeguard
Median time to create an invoice	Client-side timestamps of the invoice form lifecycle over the last 30 days; median, not average	Only operation duration and document type are recorded. Amounts, counterparties and line items are never sent to telemetry.
Registry fields autofilled	Count of mapped fields in the registry lookup, verified per release against Äriregister and EMTA responses	No user data involved
Ad and analytics trackers	Static inventory of third-party scripts in the shipped bundle (checked on every build by the secret/Domain guard)	Build-time check, not a promise
Support first-response target	Median first response time on business days, measured in the support mailbox	Reported as a target, never as a contractual SLA during the beta

Coordinated disclosure

Report vulnerabilities to security@gde.ee (PGP available on request). We acknowledge within 3 business days and give a remediation plan within 10.
Do not test against other customers' workspaces, do not run automated scanners without notice, and do not exfiltrate data. Good-faith research on your own account is welcome.
We publish a short post-mortem for every confirmed vulnerability that affected customer data, with credit to the reporter unless they prefer to stay anonymous.
No bug bounty is paid during the beta; we say so instead of implying otherwise.

GDPR, roles and Estonian bookkeeping law

When you use gde.ee for your own company, GDE Systems OÜ is the controller for account data and a processor for the business records you enter. The public DPA under Article 28 GDPR covers both cases.
Estonian accounting law requires invoices to be retained for at least 7 years. Your export is a complete, machine-readable archive, and deleting your account does not silently destroy records you are legally required to keep — you export first, then delete.
Since 1 July 2025 the Estonian Accounting Act follows the buyer's-choice model: a company registered in the Commercial Register as an e-invoice recipient may require a structured invoice (EN 16931 by default). gde.ee produces PDF invoices with EPC QR codes today; structured e-invoice output is on the public roadmap, and until it ships we will not imply otherwise.
Data subject requests (access, rectification, erasure, portability) go to privacy@gde.ee and are answered within 5 business days. Many of them you can satisfy yourself in one click: export, or delete the workspace.

Security log

Every security-relevant release and every confirmed incident, newest first. No incident has affected customer data to date.

2026-10-13releaseContact form protected by Cloudflare Turnstile plus server-side rate limits; honeypot field added.

2026-10-12releaseZero-knowledge vault documented line by line in Terms and Privacy, including the exact key-derivation parameters.

2026-10-09releaseStricter tenant separation between company workspaces, protected public payment pages, no secret keys in the browser, own protected delivery for account e-mails.

2026-10-14releaseSecurity, subprocessor and DPA pages published with versioning and change history.