Tenant isolation in the database
Every table with an organisation column is protected by row-level security. The application connects with a role that cannot bypass it, and the server refuses to boot if that is not the case.
Security
What the product guarantees, named by mechanism rather than by adjective. This is the page to send to whoever reviews a supplier.
Certificate in an envelope
The A1 certificate is stored encrypted with a per-certificate key, itself wrapped by a master key kept outside the database. The password is never stored.
Immutable authorized invoices
An authorized invoice is never edited. A change is a cancellation event signed with your certificate, followed by a new invoice. Both remain in the record.
Append-only audit trail
Every status change is an event with a hash chained to the previous one. A database trigger blocks updates and deletes on that table.
Never a duplicate
Invoice numbers are reserved under a lock, every write carries an idempotency key, and retries ask the government first. Unknown never means resend.
Mock is not production
Invoices with fiscal value only leave when a global switch is on, and that switch only works in the production environment. The sandbox cannot be confused with the real thing.
Where the data lives
Database, queue and files run on Hetzner Online GmbH infrastructure. The fiscal XML and the DANFSe are kept for six years, as the law requires, in private buckets accessed only through short-lived signed URLs. The government receives exactly what you see in the record: the signed XML.
Reporting a vulnerability
Write to security@quathos.com. We answer within two business days and do not pursue good-faith research.
Documents for your review
The four documents a reviewer asks for first, published in full.