Security and Trust

At eFirma we store data that is central to running your business - invoices, reports, and supporting documents. This page describes where that data lives, how we protect it, and how we comply with GDPR.

Hosting and data location

The application and database (PostgreSQL) run in an Amazon Web Services (AWS) data centre in Frankfurt, Germany.
File attachments - invoices, scans, and other documents - are stored on Amazon S3 in the same region (eu-central-1).
All data stays within the European Union.

Encryption

In transit: All communication between your browser and our servers is protected with HTTPS/TLS.
At rest: Both the database and file storage are encrypted with AES-256.

Access control

Each user can access only the companies they have been added to.
Within each company, we enforce a role-based access model.
Sessions are short-lived and refreshed while the user is active.
Passwords are stored as cryptographic hashes, never in plain text.

eFirma Ltd (UIC: 207862678) processes your personal data in accordance with the EU General Data Protection Regulation (GDPR). The company is registered in Bulgaria and you can look it up in the Commercial Register by that UIC. Our Privacy Policy covers in detail what data we collect, how we use it, and what rights you have.

Backups

The database is backed up on a regular schedule. Backups are kept in the AWS Frankfurt region.

How eFirma makes money

Our revenue comes only from subscriptions and AI scan packs.
We do not sell data and we do not hand it to third parties for their own commercial purposes - see the Privacy Policy.
No ads and no hidden fees.

If you stop using eFirma

You cancel a paid plan on your own, online, from the subscription settings - there is no need to contact us.
Your company moves to the free plan. Nothing is deleted: your documents remain, and you can export your invoices and revenues (CSV, Excel, PDF) at any time.
If you want everything erased, you can delete your company and account from the settings. Deletion is permanent - it is described in the Privacy Policy.

Security or compliance questions

Have a question that is not covered here - for example for a vendor assessment or an internal security questionnaire? Get in touch via our contact page and we will get back to you.