How we protect invoice and KSeF access
The safeguards used for accounts, documents and the KSeF connection.
Passwordless sign-in
You sign in with a one-time code sent to your email address. The code has a short lifetime, a retry limit and rate limits. A successful verification creates a time-limited session, so the application database does not need to store reusable user passwords.
Company data isolation
Documents, categories, contractors and audit records are always handled within the active company. The backend checks the company identifier again for bulk operations instead of trusting identifiers supplied by the browser.
KSeF secrets
KSeF tokens and certificate material are encrypted at rest. Secrets use AES-GCM with a separate master key held outside the database; encryption is also bound to the company and the secret's purpose. A certificate import password is used only to read the file and is not stored.
Sending to KSeF
Configuring a KSeF connection alone does not enable submissions: a separate configuration safeguard is required. Before sending, the document undergoes local FA(3) validation. The submitted XML is identified by its hash and, after acceptance, the system can download it again from KSeF and compare it.
If it is unclear whether KSeF accepted the first attempt, the invoice is not sent again automatically. The existing session is checked first.
Sharing documents
A public invoice link can be created only after KSeF acceptance has been confirmed. Links may expire, have an opening limit, require an emailed access code and can be revoked. Sign-in and shared-document pages are marked not to be cached.
European infrastructure
fv.converts.ninja uses Scaleway infrastructure located in Europe. Scaleway states GDPR compliance and holds ISO/IEC 27001:2022 certification for its information security management system. It also operates a dedicated CSIRT and infrastructure protections including DDoS mitigation.
A provider's certifications do not automatically certify fv.converts.ninja and do not replace application-level safeguards. They are an additional organisational and infrastructure layer.
Connection and application protection
The service uses HTTPS and applies safeguards including HSTS for secure requests, Content Security Policy, protection against framing, headers restricting camera, microphone and geolocation access, and CSRF protection for forms.
Suggestions without public AI services
Invoice content is not sent to public AI services or external language models. Category suggestions are produced in a controlled environment from only the data needed for that task. The suggestion mechanism has no KSeF credentials, and you can review or change every category before saving.
Audit log and roles
Important user actions are recorded in an audit log. A company administrator can see events created by users in that company. Administrative, KSeF and approval features are restricted by role.