How Tallio looks after your data
Security
Tallio connects your software to your merchants’ e-invoicing providers. This page says how we protect what passes through it, and which parts are still being built.
The controls in place
What we do
Hosted in the EU
The API and the site run on Vercel in Frankfurt. The database is Neon Postgres in Frankfurt.
Provider credentials encrypted
Each merchant’s provider credentials are encrypted with a key per vendor, itself wrapped by a Google Cloud KMS key in Frankfurt. This vault is being built and goes live before production traffic.
Credentials stay in
The API never returns provider credentials, and they are never written to logs.
No fiscal archive
Your merchant’s provider keeps the legal record. Tallio keeps document metadata and fetches PDFs from the provider when you ask.
Debug logs, encrypted and time-boxed
Requests and responses kept for support are encrypted and shown with personal data redacted. The policy is to delete them after 90 days; the scheduled deletion is being built and goes live before production traffic.
Safe to retry
Every create takes an idempotency key. A retry returns the first result instead of issuing a second document.
Signed webhooks
Every webhook carries a signature and a timestamp, so you can check it came from Tallio and reject replays.
Strict browser headers
The site is served with a Content Security Policy and security headers: no third-party scripts, never framed, HTTPS only.
Common questions
Questions
Tallio keeps document metadata, such as the status and the MARK, and holds no fiscal archive: the provider keeps the legal record, and Tallio fetches the PDF from the provider when you ask for it. For support, the full request and response are kept encrypted, with personal data redacted. The policy is to delete them after 90 days; the scheduled deletion is being built and goes live before production traffic.
In the EU: the application runs in Frankfurt and the database is in Frankfurt. Provider credentials will be encrypted with keys held in Frankfurt.
Not today. Tallio is in early access and holds no certification such as SOC 2 or ISO 27001. This page will say so when that changes.
Found a security issue?
Email info@tallio.dev with the details. Please give us time to fix it before you share it.