Security & compliance
Your books, protected and traceable
The product is built around three principles: nothing is posted without a person, every change is traceable, and each organisation’s data stays separate.
Audit trail
- Receipt R-2026-0142 approved · 09:14 · Role Owner
- Receipt R-2026-0141 approved · 09:02 · Role Owner
- Receipt R-2026-0139 approved · 08:47 · Role Owner
Illustrative example with sample data
Security & compliance
Control
Human approval
The AI only proposes. A booking is posted only after approval by an authorised person.
Audit trail
Approvals, corrections, exports and sign-ins are recorded with time and user.
No training on your data
Your documents are not used to train AI models.
Data
Tenant isolation
Row-level security in the database separates the data of every organisation.
Retention per § 132 BAO
Posted entries and the documents they are based on are archived tamper-proof: seven years for Austrian, eight years for German organisations. Documents not yet posted can be deleted.
GDPR
Data processing agreement according to Art. 28 GDPR. Your data is stored in Germany. In the standard mode, AI services in the USA receive documents and booking data only under data processing agreements with a recognised transfer basis (EU standard contractual clauses or the EU-US Data Privacy Framework), and keep them only for a limited time.
Your data and the AI
Each organisation decides in its settings whether AI reads its documents.
- StandardDefault
- Jev (TypeSafe) reads the document text and also helps with booking proposals, matching imported bank transactions to documents and spotting duplicates; OpenAI reads photos, scanned PDFs and, in hard cases, the whole document. If OpenAI cannot give a usable answer in a hard case, Google’s gemini-3.5-flash-lite model reads it instead. They process the data in the USA (Google also in other countries where it runs data centres). Saldek sends data to them only under their data processing agreements, with the EU standard contractual clauses as the transfer basis (for Google: the EU-US Data Privacy Framework, otherwise the EU standard contractual clauses).
- Without AI
- No data is sent to an AI provider. In this mode, documents are currently not read automatically — you enter the values yourself.
Stored in Germany
Saldek runs on servers of Hetzner in Germany, where the database with your accounting data is kept. Your document files are stored with Amazon Web Services in Frankfurt, Germany, and the encrypted database backups with Amazon Web Services in the EU. In the standard mode, the AI services keep what they receive only for a limited time; the privacy policy gives the details.
No training on your documents
Your documents are not used to train AI models — not by Saldek, and under their terms not by TypeSafe, OpenAI or Google either.
Documents
The legal documents are available in full:
Let the AI draft. Keep the final word.
Try every feature free for 30 days. No credit card required.