Security and control
Access control that is enforced in three places at once, an audit trail that outlives deletion, and infrastructure hardened by default.
Security
Permission, not job title
A role is only the starting point. What a person may actually do is the role plus their personal grants minus their personal denials — and a denial always wins.
- 61 permission keys, grouped module → component → action
- Custom roles, plus grant and deny per individual user
- Enforced on the API route, the menu entry and the page alike
Fine-grained ACL
61 permission keys as a module → component → action tree. Custom roles, plus per-user grants and denials where deny always wins — for every role, including the owner.
Enforced three ways
The same permission key gates the API route, the sidebar entry and the page route, so the three can never drift apart.
Code you cannot reach is never sent
A module a user has no permission for never has its JavaScript delivered to the browser at all.
Tamper-resistant audit trail
21 action types across 21 entity types with user, IP, timestamp and JSON detail. Foreign keys are deliberately set to null on delete so removing a user or company never erases history.
Identity and sessions
RS256 JWTs verified against a cached JWKS, httpOnly SameSite=Strict cookies, short-lived access tokens with silent refresh. No password material is stored in the invoice database.
Hardened infrastructure
Read-only containers, no-new-privileges, tmpfs scratch space, rate limiting at the edge, and hosting in Germany.
Ready to send compliant invoices?
Monthly plans, cancel any time, no setup fee — and your data leaves as PDF, XML, JSON or CSV whenever you want it to.