Your numbers stay yours.

Where your data lives

Backbone runs in the European Union. Your workspace data, documents and receipts are stored with our hosting provider in an EU region.

• Files are kept in private storage. Downloads use short-lived links that expire on their own.
• Every workspace is strictly separated from every other one. A person only sees the workspaces they were invited to.
• The public website is served through a network provider that also protects it against attacks.

Encryption

Everything between your browser, your AI tool and Backbone travels over encrypted connections (HTTPS). Stored data is encrypted at rest by the hosting platform.

• Passwords are never stored in readable form.
• You type card details at Stripe. They never reach our servers.

Roles and permissions

Everyone in a workspace has a role, and the role decides what they can see and do.

Owner

Runs the workspace, its plan and its people.

Admin

Manages clients, invoices and settings, and sees the whole team's time.

Member

Logs time and works on what their role allows.

Bookkeeper

View-only access to the books and the month-end export.

AI, with you in control

Backbone AI in the app and the connector for Claude, ChatGPT, Gemini and Grok follow the same rules as a person does.

• It signs in as you. Your role applies, so it can do what you can do and nothing more.
• It asks before anything leaves. Invoices, quotes and reminders are drafted, then wait for your OK.
• It leaves a trail. What the assistant did is recorded in your workspace, with who asked for it and when.
• You can switch it off. Disconnect an AI tool in Settings › Connections at any time.

What your AI tool itself does with your chats is governed by that tool's own settings and terms.

Not training material

Our intention is that your workspace data is never used to train AI models, and we put that in writing in the privacy policy. Backbone's own AI features run with a provider that does not use the inputs to train its models.

Invoices you can trust

• Every invoice is checked against the mandatory details of §14 UStG before it is sent.
• Once an invoice is sent, its PDF is written once and never changes afterwards, as GoBD asks for.
• That holds whether you send from the app or confirm it in a chat.

Export and deletion

• Your invoices, receipts and statements are yours to take, any time, as one ZIP, with no fee and no waiting.
• When you close your workspace, your data is deleted after [period], except what the law requires us to keep.
• Remember that you may have to keep your own business records for the statutory period. Export them before you close.

Sub-processors

These are the companies that process data on our behalf. The full list, with locations and safeguards, is in the data processing agreement.

Supabase

Database, sign-in and file storage (EU region)

Stripe

Subscriptions and card payments

Resend

Sending email: invoices, reminders, sign-in links

Anthropic

Backbone's AI features

Enable Banking

Automatic bank connection, only once you connect a bank (coming soon)

Cloudflare

Network, DNS and protection against abuse

Google Analytics

Website statistics, public website only and only after consent

Reporting a security issue

Found something that looks wrong? Write to [security contact]. We reply quickly and keep you posted until it is fixed.