Keeping your data safe
Invoices, bank accounts and staff data need proper protection. This is how we do it.
Data in the European Union
The app runs in Hetzner's data centre in Helsinki, which is ISO/IEC 27001 certified. Backups are kept with a different provider, OVHcloud, in Warsaw.
Encryption
The connection to the app is always encrypted (HTTPS). In the database we also encrypt KSeF tokens, bank transaction details, payment files, uploaded invoices and staff data. The key is never stored in the database or in backups.
A backup every night
Every night we make an encrypted backup in another data centre, with another provider. Restoring data from the backup has been tested.
Safe sign-in
Passwords are stored as Argon2 hashes. We don't accept a new password that has leaked from another site, and if you sign in with one we ask you to change it. We check this against the Pwned Passwords database from Have I Been Pwned by sending only the first 5 characters of the password's SHA-1 hash, which cannot be turned back into the password. The password itself never leaves our server. After a few failed attempts the account locks for 15 minutes. A session ends after an hour of inactivity, and one click signs you out on every device. In your account settings you can turn on two-step sign-in (2FA): a passkey, meaning the fingerprint, face or PIN you already use on your phone or computer, with no app to install, or a code from an authenticator app on your phone, one-time backup codes in case you lose the phone, and trusted devices that skip the code for 30 days.
Everyone sees only their own
Access depends on each person's role in each company. Sign-ins, exports and downloaded payment files go into a security log that the company's owner and bookkeeper can see.
Your money stays in your bank
We never ask for access to your bank account. Księguś prepares a payment file, and you send it yourself, in your own bank.
Up-to-date libraries
With every code change and once a week, we automatically check every library we use for known security vulnerabilities.
Your GDPR rights
In your account settings you can download your data and delete your account. Data we no longer need to keep is deleted automatically.
Who processes data on our behalf
We only use providers from the European Union, and the data stays in the EU.
| Provider | Used for | Where |
|---|---|---|
| Hetzner | App server and database | Finland |
| OVHcloud | Encrypted backups | Poland |
| Brevo | E-mails sent by the app | EU |
The ISO/IEC 27001 certificate is held by Hetzner and covers its data centres, not the Księguś app itself.
Report a security problem
If you find a vulnerability in Księguś, write to kontakt@twojksiegus.pl. Please do not publish the details until we have fixed it. The contact details are also in the security.txt file.