Security & Compliance

Invoices are sensitive — they contain payment data, IBANs and business contacts. Beleggo is therefore built so that this data never leaves your device in the first place. This page explains exactly how that works and how you can verify it yourself.

Local processing — no transmission

Opening, checking, repairing, creating and converting e-invoices runs entirely in your browser or local app via the Saxon-JS engine. Invoice contents, uploaded files and the XML/PDF documents you generate are not sent to our servers, not stored and not accessible to us. After the first load, Beleggo also works offline.

Verify it yourself

You don't have to take our word for it: open your browser's developer tools (the "Network" tab), load an invoice and run a validation. You'll see that no invoice data leaves the device. As a test, disconnect from the internet — the check keeps working.

What is stored in the browser

Your seller profile, saved customers, saved invoices and client records are keptencrypted in your browser's database (AES-GCM) and remain solely on your device. No plain text is left in the browser profile, in a profile backup or in a synced folder. Only settings with no personal reference — language, chosen ruleset, licence key — stay unencrypted, so that a lost key does not also reset the interface. You can remove all of it at any time via "Clear data" in the tool or your browser settings.

The key is generated by the app and sits on the same device as the data. That protects against casual access and accidental disclosure — not against a stolen or seized device. Your operating system's full-disk encryption is what protects that (FileVault, BitLocker).

Activity log and backup

Every action in the studio — checked, repaired, saved, deleted — is recorded and chained to the entry before it. The log is in the studio itself ("Activity log" in the header); editing an entry after the fact, or losing one silently, changes the check value at the end of the chain. Write that value down away from the machine, e.g. in your process documentation — only a comparison against an independently kept value says anything. The log holds no invoice contents, names or amounts.

Browser storage is not durable: a cleared cache takes everything with it, the key included. The backup therefore writes a file encrypted with your passphrase — the check value included — which can be restored on another device. That passphrase cannot be recovered. Neither browser storage nor the backup is a tamper-proof archive — export invoices to your DMS for statutory retention.

The invoice itself is untrusted input

An incoming invoice comes from somebody else, so it is treated as untrusted input rather than as a document from your own office:

• An attachment is never shown as itself. Beleggo does not put an attachment's bytes in front of the browser — no iframe, no object URL in an image, no HTML from the document reaching the page as markup. What is shown is the parsed model: text and tables, as text and tables.
• File names are checked. Control characters that reverse how a name is drawn can make an executable look like a PDF in a file manager. Beleggo reports that, and the name it suggests when you save the attachment no longer carries those characters. A file name that is really a path is reported too.
• A linked attachment becomes a link only when it points at a web or mail address. A javascript: or data: reference — BT-124 is written by the sender — is displayed, so you can see what the invoice says, but it is not clickable.
• The validation engine fetches nothing. External references inside the XML are not resolved, and the Content-Security-Policy allows connections to this origin only. Checking an invoice therefore cannot tell anybody that it is being checked.

Sub-processors

To operate the website and process Pro purchases we use a few providers — none of which have access to your invoice data:

• Cloudflare Pages — website hosting (delivery, server logs).
• Stripe — payment processing for Pro licence purchases.

See the privacy policy for details.

Validation engine and currency

Our engine is cross-checked against the official KoSIT test invoices and the official KoSIT validator — automatically, in our CI. The rule sets in use (KoSIT, XRechnung, Peppol) are bundled with versions and monitored against the official sources, so changes don't go unnoticed.

Responsible disclosure

If you find a security vulnerability, please report it confidentially tosecurity@beleggo.de before disclosing it publicly. We will acknowledge receipt and work on a timely fix. See also oursecurity.txt.

Certifications (roadmap)

Beleggo is not currently ISO 27001 or SOC 2 certified. The local, server-less approach significantly reduces the attack surface, since invoice data never leaves the device. We are evaluating formal certifications as the product grows.

Last updated: July 2026.