Home / Security

Your invoices, handled with care

Vattora reads only what it needs, keeps secrets secret and logs everything it does.

For databases we ask for a read-only login, so Vattora can read posted invoices and cannot change them.

The agent calls out over HTTPS. Nothing online can connect to it.

Passwords and API keys are typed by you through a one-time secure link, stored encrypted and never shown in full.

On Oracle Cloud Infrastructure, Dubai region.

Connection changes and each document's journey, logged with time and user.

Your ASP handles Peppol exchange and reporting to the Federal Tax Authority.

The agent

What the agent can and cannot do

For desktop and on-premises systems, a small Windows service runs next to your system. Your IT can read this list before installing it.

Reads posted invoicesFrom the folder or database login your IT allows.

Calls outTo Vattora over HTTPS; to your database or Tally on your network.

Nothing can connect to itNot from the internet and not from other PCs.

Cannot change your invoicesWith a read-only login it can only read.

We walk them through the agent, logins and network rules before installing.