Security & your data
Built to be trusted with your bills.
Your invoices show your costs and who you work with. We treat them that seriously. Here's exactly what we do to keep them safe — in plain words.
Your data stays in the EU
Everything is hosted on servers in the European Union, kept separate from every other company's data.
We don't keep your original bills
Once we've read the numbers out of a document, we don't store the file itself — only the figures your report needs.
Passwords are never stored in plain text
We only ever keep a scrambled (salted PBKDF2-hashed) version of your password. Even we can't read it.
Connections are encrypted
All traffic between you and CarbonProxy is encrypted in transit (HTTPS).
Never used to train AI
Your documents and figures are used only to make your report. They are never used to train any AI model, and never sold.
You can delete everything, instantly
Download a full copy of your data, or delete your account and all its data, right from your workspace — no email tickets, no waiting.
Abuse protection
Sign-in, sign-up and other sensitive actions are rate-limited to protect your account from automated attacks.
For your compliance team
Need a data-processing agreement (DPA) for your records? Start from our template and email us to sign a final version.
Formal SOC 2 certification isn't in place yet — we'll pursue it as enterprise customers require it. We're happy to walk your security team through the above in the meantime.