Security and data protection
This page summarises where Facturx-Prêt is operated, how long files are kept, how they are checked and which providers are involved. The legal details are in the privacy policy.
Hosting and server access
The website and the service run on servers of Hetzner Online GmbH in the Nuremberg data centre (Germany), within the European Union. Facturx-Prêt is published by Radom UG (haftungsbeschränkt), a German company based in Frankfurt am Main.
Connections between your browser and our server are encrypted with TLS; HTTP is redirected to HTTPS, and HSTS tells browsers to use HTTPS only.
Administrative access to the servers is by SSH key only, with a firewall that opens only SSH, HTTP and HTTPS to the public. Access is restricted to the managing director and persons he expressly authorises, who are bound to confidentiality.
Retention and deletion
Uploaded files and generated results are stored under a technical identifier, without their original file name and without your name or e-mail address; the file contents remain unchanged.
They are deleted automatically after 7 days in guest mode and after 90 days with an account (daily purge). You can ask for earlier deletion at support@facturx-pret.fr.
With an account, you can delete your account yourself from “My account”: the invoice files of your account are erased first (otherwise the account is not deleted), then the seller profile, the saved clients and the invoice history are deleted with it.
Invoice files are included in no backup. The account database (not the uploaded files), which also holds the seller profile and the client book you have saved as well as the history of your invoices, is backed up every day, on the same server and by a copy on a second Hetzner server in Nuremberg; these backups are kept for 14 days.
The web server access logs are deleted after 14 days.
Checks before download
Before handing you a Factur-X file, the service checks the XML against the Factur-X schema (XSD) and the rules of the EN 16931 standard (Schematron), and the PDF against the PDF/A-3 standard (veraPDF).
These checks run on our own server; no data is sent to third parties for them. If a check cannot give its verdict (for example because a service is temporarily unavailable), no file is delivered: you can try again a few minutes later.
These checks do not replace your own review of the invoice: its mentions and its VAT treatment remain your responsibility (terms, article 6).
AI-assisted reading
For some uploaded files, the content is sent to the Azure OpenAI Service of Microsoft Ireland Operations Ltd.: images, PDFs without usable text or with an uncertain extraction, MT940 statements, XML that is neither CII nor a camt.053 statement, and CSV or Excel files uploaded one at a time whose column structure is not recognised.
Microsoft Azure OpenAI Service — regional (Standard) deployment in the Azure region Sweden Central (EU): requests are processed there.
Entry in the form, generation of the Factur-X XML, validation and the batch processing of CSV and Excel files do not use AI. The extracted data is shown to you for review: you check it before generating the file.
According to Microsoft's terms, the content sent is not used to train the models. The details are in section 8 of the privacy policy.
Providers and sub-processors
The first three providers in the table may receive the content of your invoices (Google only if you send it to support by e-mail): they are the sub-processors of Annex 3 of the data processing agreement. The others process only account, billing or audience data, or the VAT numbers you check, and never receive the content of your invoices.
| Provider | Purpose | Location | Role |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, storage and backup | Nuremberg, Germany | Sub-processor |
| Microsoft Ireland Operations Ltd. | Azure OpenAI: AI-assisted reading in the cases described above | Regional (Standard) deployment, Sweden Central region (EU) | Sub-processor |
| Google Ireland Limited | Google Workspace: support and e-mails; invoice content only if you send it to support by e-mail | EU (transfer to the USA not excluded, see the privacy policy) | Sub-processor |
| Stripe Payments Europe, Ltd. | Payment of subscriptions | Ireland (transfers to the USA possible, see the privacy policy) | Payment provider (processor and, in part, separate controller) |
| PostHog Inc. | Audience measurement, only with consent | EU cloud (eu.i.posthog.com) | Processor |
| Umami | Audience measurement, only with consent | Nuremberg, Germany (instance operated by Radom UG, on the same server as the service) | Tool operated by Radom UG |
| European Commission (VIES) | VAT number verification | EU | Recipient (public service) |
Protection against abuse
To protect the service against abuse, we limit the number of sign-in, registration and password reset attempts, as well as contact form submissions and VAT number checks; conversions and file analyses are subject to quotas. Passwords are stored only as a bcrypt hash.
The application's internal interface and the validation services are reachable only locally on the server, and the interface is protected by an internal key.
Status of the service and certifications
Facturx-Prêt is not an approved platform: the service generates a Factur-X file that you download. It does not transmit your invoices and is not connected to the French public invoicing portal.
Radom UG (haftungsbeschränkt) holds no security certification.
Data processing agreement and contact
For business use, the data processing agreement under Art. 28 GDPR is an integral part of the terms: it is concluded by accepting the terms at registration and published at facturx-pret.fr/en/accord-sous-traitance.
It applies only to customers with an account, because guest users do not accept the terms.
For any question about security or data protection, use the contact form or write to support@facturx-pret.fr.