Security
How Syllevo protects your data
Accountants hand Syllevo their clients' financial documents. That only works if the answers on this page are specific, verifiable, and true. Here they are. If anything is unclear, ask us directly.
Your documents stay in the EU
- Your documents, the data read from them, and everything else in your profiles are stored in the European Union: the database, the document store, and the infrastructure between them.
- Third-party processing uses EU regions wherever the vendor offers one, as our error tracking does. Some vendors handle limited personal data in the United States: our sign-in provider sees your name and email address, and our email delivery service carries the emails we send, including any invoice you ask us to email to a buyer. The privacy policy names every vendor and the safeguard for each transfer.
- This website sets no trackers and loads no third-party scripts. It asks before setting its one optional cookie, which credits the person who referred you, and it works the same if you decline.
Encrypted in transit and at rest
- Every connection to Syllevo from the internet uses TLS, and so do our connections to the services we rely on, such as ANAF, Stripe, and our document storage.
- Databases and document storage are encrypted at rest.
- Credentials and connection tokens (such as e-Factura tokens) get an extra layer: they are encrypted with AES-256-GCM before they ever reach the database.
Never lose a document
- Originals are stored immutably and addressed by their content. Nothing can overwrite an invoice once it has arrived.
- A monthly job verifies storage against the database in both directions, so a missing or orphaned file is found by us, not by you.
- Every access that matters (exports, permission changes, document downloads) lands in an audit trail.
- The database is backed up daily with point-in-time recovery, and backups stay in the EU.
Access is denied by default
- Every request must carry an explicit permission. Anything not explicitly allowed is rejected, through the same enforcement point for humans and API keys alike.
- Firms control access per client company: a team member sees exactly the clients they were granted, nothing more.
- Multi-factor authentication is available to every account.
GDPR: who is responsible for what
Under GDPR, Syllevo (Businice S.R.L.) is a data processor for everything in your account, and your organization is the data controller. We are the controller only for data about our customers themselves, such as accounts and billing, and about the people in our referral program. Your data is processed on your instructions, and export is a real, executable operation in the product, per organization and per client.
Our data processing agreement is a section of our terms of service, so every organization has it from the day it accepts them, with nothing separate to sign. Write to legal@syllevo.com with any question about it.
Sub-processors are listed in the privacy policy, and the list is maintained: adding one is a deliberate decision, never a silent change.
Export and deletion are never gated
You can export every original document and all structured data at any time, on any package, during a grace period, after a refund, and at cancellation. Data portability is not a feature tier.
Deleting your organization offers a full export first, then removes your data on a stated schedule (database rows, stored documents, and, as they expire, backups). Deletion is audited and confirmable.
Found something? Tell us
Security reports go straight to people who can act on them. Write to security@syllevo.com