What Paylo actually does to protect your invoices, approvals and payments — and, just as important, what it does not do.
Paylo applies multiple independent security controls so that a single failure is less likely to compromise your business's payments.
Every invoice runs through automated checks. Duplicates, amounts far above a vendor's usual, first invoices from new vendors, bank accounts that differ from the one on file, invalid VAT IDs and incomplete invoices are flagged for review before a payment is made.
Bank-connection and mailbox access tokens are encrypted by Paylo with AES-256-CBC before they are stored. The database is additionally encrypted at rest by the hosting provider. Data in transit is protected by TLS (versions 1.2 and 1.3 are accepted; older versions are refused).
Approvals, changes to booking-relevant invoice fields, payments and exports are logged with time and actor. The database itself rejects edits and deletions of log entries. Exportable as CSV at any time.
Bank connections go through a licensed Open Banking provider (Yapily). Your online-banking credentials are never seen or stored by Paylo — you authenticate in your own bank, and access can be revoked at any time.
Paylo never stores your online banking username or password. Bank connections are limited to what is needed for payment initiation, and the Gmail connection is read-only. You can revoke access at your bank or in your Google account at any time.
Every database table enforces row-level security at the database layer — not just the application. Each business can only access their own data, enforced independently of the application code.
Paylo is built with privacy by design. You always have full control over your business data.
Export and account closure are available directly in the app. Some records cannot be deleted immediately because German tax law requires businesses to keep invoices and payment records for 8 years — see "Right to erasure" below.
Paylo is a software platform. Payments are initiated through a licensed Payment Initiation Service Provider (PISP); Paylo itself holds no payment licence and never holds your money.
Bank connections are made through a regulated Open Banking provider (Yapily). Paylo does not connect to banks directly — the licensed intermediary handles all bank communication. Open Banking payments are available for supported banks in the EU and UK.
Every Open Banking payment is authorised by you in your own bank with Strong Customer Authentication (SCA). Paylo cannot execute a payment without that confirmation and never handles your banking credentials. Prefer to stay fully manual? Download a SEPA file and upload it in your online banking.
Bank connections request only the permission needed to initiate payments. Access can be revoked at your bank at any time.
Every payment initiated through Paylo is logged with a reference, timestamp, amount and beneficiary. Payment records cannot be deleted during the retention period, and the audit log is append-only.
Every invoice runs through these checks before it reaches your queue. A flag asks a person to look — it reduces risk but cannot guarantee that fraud is caught.
Built around the German requirements for keeping invoices (GoBD, §147 AO, §14b UStG). Paylo supports your obligations; it is not an officially certified product and does not replace advice from your Steuerberater.
Each document is stored exactly as received, named by its SHA-256 fingerprint, in a private bucket. The database refuses to replace or alter an archived original, and the fingerprint is re-checked every time the file is opened or exported.
Invoices, payment records and originals cannot be deleted before the end of the calendar year of receipt plus 8 years. After that they are removed automatically. Account closure does not shorten this.
Edits to booking-relevant fields (amount, VAT, dates, vendor, category) are recorded with the old and new value, time and user in the append-only log.
One ZIP with all originals, an index with fingerprints, line items, the change log, an integrity report and a Verfahrensdokumentation template for you to complete and review with your advisor.
A company can give its tax advisor read-only access by email. The advisor can see invoices and original documents and download the DATEV file and GoBD archive — nothing else: no payments, no bank data, no settings. Access is checked on every request against the verified email of the advisor's account, can be withdrawn by the company at any time with immediate effect, and every export and document view is written to the company's audit log. A Kanzlei sees all companies that invited it in one overview.
The companies that process data on our behalf, and where. Details and legal bases are in the Datenschutzerklärung.
| Component | Provider | Location |
|---|---|---|
| Application server | Hetzner Online GmbH (cloud server) | Helsinki, Finland 🇫🇮 EU |
| Database | Supabase (PostgreSQL) | EU region (Ireland) 🇮🇪 EU |
| Email delivery | Resend | Transactional email only (approval and notification emails) · USA, standard contractual clauses |
| AI invoice reading | Anthropic (Claude API) | Invoice content (text, PDFs, images) is sent to Anthropic to be read · USA, standard contractual clauses |
| Payment initiation | Yapily (Open Banking) | Regulated Open Banking provider · used only if you connect a bank |
| Error monitoring | Sentry | EU region (Germany) 🇩🇪 EU · technical error reports |
| VAT-ID validation | EU Commission VIES | Supplier VAT IDs are checked against the official EU service EU |
| Gmail import (optional) | Google Gmail API | Read-only, only if you connect Gmail · USA, standard contractual clauses |
| Transport encryption | Caddy web server (automatic certificates) | TLS 1.2 and 1.3 only; HTTPS for all traffic |
A quick reference for procurement, legal, and compliance teams evaluating Paylo.
Happy to answer questions from your legal, procurement or compliance team.
Contact our team View pricing