Paylo is built in Berlin, Germany. Every invoice, approval, and payment is protected by the highest security standards — GDPR compliant, PSD2 partner, AES-256 encrypted.
Paylo applies multiple independent security controls so that no single failure can compromise your agency's payments.
Every invoice is scanned before processing. Duplicate invoices, unusual amounts, unknown vendors, and changed payment details are automatically flagged for review before any payment is sent.
All bank tokens and sensitive data are encrypted at rest using AES-256-CBC. Data in transit is protected by TLS 1.3 — the same standard used by major European banks.
Every invoice action, approval decision, and payment is timestamped and permanently logged. Exportable as CSV at any time for compliance review, accountants, or GDPR data subject requests.
Bank connections use licensed PSD2 Open Banking providers only. Your bank credentials are never seen or stored by Paylo — authorisation uses short-lived OAuth tokens revocable at any time.
Paylo never stores your online banking username or password. Bank connections use OAuth 2.0 tokens with the minimum required permissions. You can revoke access from your bank at any time.
Every database table enforces row-level security at the database layer — not just the application. Each agency can only access their own data, enforced independently of the application code.
Paylo is headquartered in Berlin, Germany and fully complies with the General Data Protection Regulation (EU) 2016/679.
Every GDPR data subject right is available to Paylo users directly from the Account settings page — no need to contact support. Data export and account deletion are available in one click.
Paylo operates as a technology platform using licensed PSD2 Payment Initiation Service Providers (PISPs) for all bank connections.
All bank connections are made through regulated PSD2 Open Banking providers licensed by their respective national competent authorities. Paylo never directly connects to banks — licensed intermediaries handle all bank communication under PSD2 regulation.
All payment authorisations require Strong Customer Authentication (SCA) as mandated by PSD2. Clients authorise payments through their bank's own secure authentication interface — Paylo never handles authentication credentials.
Bank connections use OAuth 2.0 with limited scopes — payment initiation only. Read-only account information is requested separately and only when explicitly authorised. Tokens can be revoked by the client at their bank at any time.
Every payment initiated through Paylo is logged with a unique reference, timestamp, amount, beneficiary, and authorising user. This provides a complete, tamper-evident record for regulatory review or dispute resolution.
Every invoice is scanned by our AI engine before any human sees it. Suspicious invoices are flagged automatically — preventing fraud before it happens.
All Paylo infrastructure is located within the European Union. No data is transferred to the United States or other third countries without appropriate GDPR safeguards.
| Component | Provider | Location |
|---|---|---|
| Application server | Hetzner Cloud CPX22 | Nuremberg, Germany 🇩🇪 EU |
| Database | Supabase (PostgreSQL) | EU region (Frankfurt) 🇩🇪 EU |
| Email delivery | Resend | GDPR-compliant, EU data processing available EU |
| AI processing | Proprietary AI engine | Invoice text processed in-memory — not stored or retained by the AI provider |
| Payment initiation | Yapily (PSD2 licensed) | UK/EU regulated Open Banking provider EU |
| SSL certificate | Let's Encrypt | TLS 1.3 enforced on all connections |
A quick reference for procurement, legal, and compliance teams evaluating Paylo.
Our team is based in Berlin and happy to answer questions from your legal, procurement, or compliance team.
Contact our team View pricing