This page describes the technical and organisational measures we apply under Article 32 of the GDPR and Law no. 124/2024. It is an annex to the Data Processing Agreement.
1. Infrastructure
- The servers and the database are located in the European Union, in the Netherlands (DigitalOcean, Amsterdam).
- The database is not reachable from the internet. It connects only to the application servers.
- The operating system and the application components are regularly updated with security patches.
- We continuously monitor service availability and technical errors.
2. Traffic protection
- All traffic is encrypted with HTTPS (TLS), with HSTS so that the browser never connects without encryption.
- Cloudflare sits in front of the application and protects it from DDoS attacks, bots and malicious requests.
- Account login limits the number of attempts, per IP and per user, to stop password guessing.
3. Access and permissions
- Passwords are stored only as bcrypt hashes. Nobody, not even our team, can read them.
- API tokens and integration secret keys are stored hashed and shown only once, when they are created.
- The business administrator sets each user's permissions: which modules they see, who cancels invoices, who sees the reports.
- Sessions are encrypted and protected against CSRF attacks.
4. Separation between businesses
Every database query is restricted to the business, unit and fiscal device of the user who makes it. One business cannot see another business's data. Accountants and resellers access only the businesses that have invited them or been assigned to them, with the permissions they have been given.
5. Data protection
- Keys for external services and certificate passwords are stored encrypted.
- We make regular backups of the database, stored in the EU.
- We do not send personal data to the error logs.
- You can export your invoices, customers and products at any time.
6. Fiscalisation
- Every invoice is digitally signed with your business's certificate before it is sent to the tax authority.
- The XML messages we send and the tax authority's responses are kept in an archive that cannot be altered, for audit.
- When the tax authority's system does not respond, invoices are saved and fiscalised automatically as soon as it is back.
7. Activity logging
- Every change to the business's configuration is logged: who made it, when and what changed.
- When our team or an accountant enters your account, the access is logged under their name.
- API calls are logged by the token and the application that makes them.
8. Our team
- Only the people who maintain the production systems have access to them, and only as much as they need.
- All of them are bound by contract to maintain confidentiality.
- The support team enters your account only at your request or to resolve a technical problem.
9. Incidents
If a breach occurs that affects your data, we notify you without delay and no later than 48 hours after we learn of it, with what we know and the measures we are taking, so that you can notify the Commissioner within the legal deadline.
10. Report a security problem
If you find a vulnerability in Fature.al, write to us at [email protected]. Please do not make it public and do not access other businesses' data until we have fixed it. We respond to every report.