Security
How we protect your information
Your invoicing data is sensitive. Here we explain, without unnecessary jargon, what measures we take and why. Every claim on this page is backed by the code the app actually runs.
Data on your device, not on Emitia servers
Your clients, invoices, prices and settings are stored on your own device. Emitia does not host your invoicing data on its servers. When you use the app, you work against local storage.
End-to-end encryption
All your data is encrypted before being stored or synced. We use authenticated encryption (AES-256-GCM), which not only protects the content but also detects if someone has tampered with it. Without your key, the data is unreadable.
Backup in your own Google Drive account
If you enable sync, backups are stored in your own Google Drive account, not on an Emitia server. You control access to that account. We do not keep a copy of your data.
Not even Emitia can read your data
Since your data is encrypted with your key before leaving the device and stored in your Drive, Emitia has no access to the content. Even if we could access the file, we would only see meaningless encrypted data.
The exception: voice and AI
Voice and AI assistant features (dictation, item suggestions, contact import from a photo) process that specific content through an external provider (OpenAI) to generate the result. The rest of your invoicing stays local and encrypted, never passing through our servers.
VeriFactu: chained fingerprints and digital certificate
For VeriFactu submissions, each record generates a cryptographic fingerprint (SHA-256) that includes the previous record's fingerprint, forming a chain that cannot be altered without detection. The submission is signed with your digital certificate and sent directly from your device to the AEAT.
Technical questions?
If you have questions about how Emitia's security works or need more detail, write to us. We respond in Spanish, Catalan, Galician, Basque, Asturian and English.