Kobrio stores your business information and, often, your clients’ information too. Here we explain how we look after it, without absolute promises: no system is invulnerable, but we can tell you what we do.
Your invoices, expenses and reports are seen by you, the people you invite to your team and the adviser you assign, each with their own role. The adviser only has read access. Removing someone takes effect immediately.
You can only sign in by invitation: with an email link, with your Google or Microsoft account, or with a passkey (the fingerprint, face or PIN of your phone or computer). You always need a second factor as well, which can be that same passkey or a code app, and sensitive actions ask for it again.
All traffic is encrypted (TLS). Your clients’ personal data (name, NIF, address and email) is stored encrypted with a key that is not kept in the database, as are the integration keys. Files are kept in private storage and can only be opened with signed links that expire shortly.
The app and the database run in a data centre in the European Union (the Netherlands) and files are kept in storage under EU jurisdiction. The specific providers are in the list of sub-processors on this page.
To extract the details from a receipt, we send the AI provider only that document, with no data from other customers, and we set it up with no retention for training. You always check the details before saving them.
The people on your team get in, each with the permissions of their role, and so does your adviser, if you invite them, with read-only access. Kobrio support only gets in if you give them permission, for 1 or 7 days, and you can withdraw it whenever you like. Sensitive actions, downloads and every page support views are recorded in the activity log, which you can view and download.
Your clients’ and suppliers’ data is yours: you are the controller and Kobrio processes it on your behalf. Before issuing your first invoice, you sign a data processing agreement in the app that sets out what we can do with it (only provide the service to you) and what we can’t.
The data for your own account (name, email, sign-ins, subscription) is processed by OrchOps, S.L., the company behind Kobrio, as controller. All the details are in the privacy policy.
Invoices, expenses and receipts are kept for as long as you use Kobrio. If you close your business, they are kept for 6 years from the end of the year of your last invoice or expense and you can download them in full with “Download everything”; we let you know before deleting them.
These are the services we use to provide Kobrio, in alphabetical order. Your own cloud, if you connect it for backups, is a provider of yours, not a Kobrio sub-processor. When any of them processes data outside the European Economic Area, it does so with the safeguards the GDPR requires.
| Provider | What for | Where |
|---|---|---|
| Anthropic | AI for reading documents (receipts and invoices, purchase orders, price lists, POS summaries and consent documents) and for the assistant, setup suggestions and translating descriptions, depending on the model Kobrio assigns to each task. Its commercial terms exclude using this data to train its models. | Storage in the USA; processing in any country |
| B2Brouter | Issuing invoices and sending the records to VERI*FACTU (AEAT) or TicketBAI, and checking clients' and suppliers' NIF in the AEAT census, when it is your business's invoicing provider | European Economic Area |
| Cloudflare | DNS, network and protection, files (R2), incoming expenses email, businesses' own domains, anti-spam check on the form (Turnstile) and this website | Files in the EU; global network |
| Dropbox | Only if you connect your own Dropbox account for backups: it is a provider of yours, not a Kobrio sub-processor | Depends on your Dropbox account |
| Sign in with Google and address autocomplete (Google Places). If you connect your own Google Drive for backups, Google Drive is a provider of yours, not a Kobrio sub-processor | USA and EU | |
| Google (Gemini) | AI for reading documents (receipts and invoices, purchase orders, price lists, POS summaries and consent documents) and for the assistant, setup suggestions and translating descriptions, depending on the model Kobrio assigns to each task, under the paid tier of the Gemini API, whose terms exclude using this data to improve its products. | Any country where Google has facilities |
| Invopop | Issuing invoices and sending the records to VERI*FACTU (AEAT) or TicketBAI, and checking clients' and suppliers' NIF in the AEAT census, when it is your business's invoicing provider | EU |
| Microsoft | Sign in with Microsoft and, if you choose to, use your Microsoft photo. If you connect your own OneDrive for backups, OneDrive is a provider of yours, not a Kobrio sub-processor | No fixed region: Microsoft's global service |
| OpenAI | AI for reading documents (receipts and invoices, purchase orders, price lists, POS summaries and consent documents) and for the assistant, setup suggestions and translating descriptions, depending on the model Kobrio assigns to each task. Its API terms exclude using this data to train its models. | No fixed region: any country where OpenAI processes data |
| Railway | App servers and database | EU (europe-west4 region) |
| Resend | App emails: sign-ins, invitations, invoices and alerts | USA |
| Sentry | Technical error tracking for the app, with personal data redacted | EU (Germany) |
| Stripe | Subscription payments and, if you turn them on, payment links for your clients | EU (Ireland) and USA |
If we add or change a sub-processor, we’ll update this page and let you know before the change takes effect.
Write to us and we’ll reply in detail. You can also exercise your data protection rights through the form.