Trust

EU data residency

Invoice content is ephemeral by default. Account and usage metadata stay in the EU.

Processing

Generate / validate / parse run on Hetzner in Germany. The KoSIT validator sidecar is co-located. Invoice payloads are not written to the database.

Metadata

Organizations, API key hashes, and usage counters live in Neon (Frankfurt). Offsite backups of that metadata go to a Hetzner Storage Box (EU).

Website

Marketing site and dashboard are on Vercel with an EU region. Auth cookies and dashboard sessions follow Better Auth configuration at https://normbill.com.

Platform guarantee

Contractual EU residency language is part of the Platform conversation — contact us. Subprocessors: see Datenschutz / AVV.