Security
Trust and Security
Last updated: September 2026
codecafe24 is built so invoice documents are processed and returned on the same encrypted connection. Account and billing records are stored because you need a workspace — not because we keep a copy of every XML you send.
Encrypted in transit
Production API and website traffic use TLS. Plain HTTP is not used on the public site.
Invoice files are not archived
Create, validate, convert, and render payloads exist for the request. They are not stored in MongoDB as invoice copies.
EU region
Application servers run on AWS in Frankfurt (eu-central-1). Account data stays in the EU MongoDB cluster.
Accounts, not invoice vaults
We store what we need to run the product: users, keys, quotas, billing status, and support tickets — not your customer invoices.
Architecture
Your application calls our API over HTTPS. We transform or validate the payload in process memory and stream the result back. When the response is finished, the invoice content is gone from our application servers.
What we do store: email, plan, API key metadata, usage counters, and contact-form messages in MongoDB. What we do not store: the invoice XML/PDF body after the call returns.
Infrastructure
- Amazon Web Services — compute and networking in Frankfurt, Germany (eu-central-1).
- MongoDB — GDPR-oriented account database in the EU. Used for workspaces, keys, quotas, and support — not as an invoice archive.
- Polar — checkout and subscriptions. Payment cards stay with Polar.
Access
Production access is limited to operators who need it. Invoice content is not sitting in a browseable store for employees to open after the fact.
Your controls
Rotate API keys from the dashboard. Close the account when you leave. For a security report, use the contact form and mark it as a security query.
Privacy details, including GDPR rights, are in the Privacy Policy. Contract terms are in the Terms of Service.