HiveClerkHiveClerk
Sign inStart free

Security & data

Invoices contain sensitive business data. Here is, in plain words, where your documents go, how long we keep them and how they are protected.

Where your data is stored

  • Files, extracted data and accounts are stored in Frankfurt, Germany (Supabase, on AWS eu-central-1). Daily backups are kept for 7 days.
  • The application's server functions run in Frankfurt (Vercel, region fra1). Static pages of this website are served from Vercel's global network.
  • Emails (sign-in codes and the invoices you forward to your HiveClerk address) are handled by Resend in the EU (Ireland).

The AI extraction step

Data is extracted from your documents by Anthropic's Claude model, through the Anthropic API. This is the one step that leaves the EU: according to Anthropic's documentation, data stored by the API is stored in the United States, and processing may run in any region where Anthropic operates.

  • Anthropic automatically deletes API inputs and outputs within 30 days, except where it must keep them longer by law or where its automated trust-and-safety systems flag content as violating its Usage Policy (then up to 2 years).
  • Anthropic does not use this data to train its models.

Sources: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data, https://platform.claude.com/docs/en/manage-claude/data-residency, https://platform.claude.com/docs/en/manage-claude/api-and-data-retention.

How long we keep your documents

  • Original files and emails are deleted automatically 30 days after receipt. You can delete any document yourself at any time. Choosing another period (7, 30, 90 or 365 days) will be possible in Settings.Coming soon
  • Extracted data (fields and line items) stays in your account until you delete it, and is deleted within 30 days after you close your account.
  • HiveClerk is not an archive: keep the originals you are legally required to retain in your own records.

No training on your documents

Your documents are processed only to provide the service to you. We do not use them to train AI models, and neither does our AI provider.

How your data is protected

  • Encryption in transit (TLS) and encryption at rest by our hosting providers.
  • Files are kept in private storage, opened only through short-lived signed links.
  • Database row-level security: each account can only see its own documents and data.
  • Sign-in by one-time code sent by email; no passwords to leak.
  • Access to production systems is restricted to the operator.

Report a security issue

If you believe you have found a security vulnerability, please write to support@hiveclerk.com with "Security" in the subject. We will reply within 1 business day.

The full details, including the list of sub-processors and your rights, are in our Privacy Policy.