Security and your data

Plain answers, product by product. Each product's privacy notice is the full, binding version; this page summarises it.

Invoicing Flow Mail Cloud Bank Connector

In short

We are a Cyprus (EU) company. Your data is stored with Google Cloud, Cloudflare and OVH, and each product's privacy notice says exactly where.
Every connection uses TLS. Passwords and connection keys you give us are stored encrypted; bank figures are encrypted with a separate key for each company.
Every night an encrypted backup goes to three providers: OVH (Germany), Cloudflare R2 (EU) and Google Drive, which may store it outside the EU. Only CySo holds the key, and copies expire within 6 months.
You can export your data and delete your account yourself. AI tools only touch your data when you switch them on.

CySo Invoicing

Where it is stored: Your invoices and documents stay on your device and in the cloud storage you connect (Google Drive, OneDrive, Dropbox or WebDAV); we don't store those files, except copies you choose to share with your accountant in CySo Flow or with an AI connector. Your account and settings are kept with Google Firebase and Cloudflare; payments go through Stripe.
Encryption: TLS for every connection. Your email (SMTP) and cloud-storage logins are stored encrypted. An optional backup passphrase encrypts your own backup on your device (AES-256-GCM).
Export: Invoices → Export. A full machine-readable copy of your account data on request to [email protected].
Deleting your account: Settings → Account → Delete my account. Security logs are deleted within 90 days and encrypted backups expire within 6 months. You can also choose to erase your cloud backup.
Legal: Privacy · Terms · More about Invoicing

CySo Flow

Where it is stored: Records: Google Cloud Firestore, eur3 multi-region (Belgium and the Netherlands). Files: Cloudflare R2, EU jurisdiction. The built-in AI Assistant uses Google Vertex AI in the EU (europe-west1) when you use it; if you add your own AI key, that provider may process data outside the EEA.
Encryption: TLS with HSTS. Stored data is encrypted by the providers with keys they manage. Credentials and AI keys you connect are encrypted with AES-256-GCM.
Export: Settings → Data & Backup → Full backup (JSON), plus Excel and CSV exports.
Deleting your account: Settings → Data & Backup → Delete my account. You have 30 days to export or cancel; then everything is destroyed, except our own invoices to you (kept 7 years for tax) and your colleagues' own sign-in accounts, which are theirs. Encrypted backups expire within 6 months.
Legal: Privacy · Terms · DPA · More about Flow

CySo Mail Cloud

Where it is stored: Account, mailbox settings and approvals: Cloudflare, EU jurisdiction. CySo does not keep copies of your emails; drafts and attachments stay in your own mailbox or Drive. If you connect Telegram, approval requests go through Telegram, outside the EU.
Encryption: Mailbox passwords are encrypted in your browser before they are sent and stored with AES-256-GCM, one key per secret.
Export: Settings → Your data → Download my data (passwords and keys are not included).
Deleting your account: Settings → Your data → Close the account: everything, including the activity log, is deleted at once; encrypted backups (no email bodies or attachments, but they can include recipients and subjects of approval requests) expire within 6 months.
Legal: Privacy · Terms · DPA · More about Mail Cloud

CySo Bank Connector

Where it is stored: Cloudflare: database in the Western Europe region; today's bank read in Cloudflare's short-term store on its global network. With “Delete every night” (the default for new accounts), data read from your banks is kept only until midnight (Cyprus time) and is never backed up; Viva movements are kept 90 days. The connection is read-only: it can never move money.
Encryption: Every bank value is encrypted with AES-256-GCM using a key for your company. CySo is technically able to decrypt it, but does so only when you ask for help or the law requires it.
Export: Settings → Your data → Download all transactions (CSV).
Deleting your account: Settings → Delete my account and all data: immediate. Recovery copies expire within 30 days and encrypted backups within 6 months.
Legal: Privacy · Terms · DPA · More about Bank Connector

AI and your data

AI apps (ChatGPT, Claude) only reach your data through a connector key you create, with the permissions you choose; sending, issuing invoices and recording payments wait for your approval. Text from your records is passed to the AI marked as information, not instructions, but AI models can still be misled, so keep important actions on approval.

Security question or a vulnerability to report? Email [email protected].