Security
An invoice is commercially sensitive: who your customer is, what you charged them, and when. This page says what happens to one when you send it to us, and it names the things we do not have.
What happens to an invoice you send us
It is processed in memory and never stored. A request
to POST /v1/validate or POST /v1/generate is
parsed, run through the validation engine, and answered. When the
response is written, the payload goes out of scope with the request.
There is no database of invoices, no object storage bucket, no queue and
no cache holding one. There is nothing for us to go and look at later,
which is also why we cannot help you re-run yesterday's document.
It is never used to train anything. There is no model here to train — the engine is deterministic TypeScript, a rule set compiled from EN 16931 — and we do not send payloads to any third-party service, AI or otherwise.
Responses carry Cache-Control: no-store.
So neither Cloudflare's cache nor an intermediary proxy retains the
result of a validation.
Logging, stated precisely. We do not log invoice
payloads in normal operation. What we keep is what we need to run the
service: a request count per key, and the fact that a call happened.
The validation and generation paths log the error class name and
nothing else — never the document, never a field value. One caveat we
would rather write down than have you discover: a catch-all handler
records a stack trace if a request crashes somewhere unexpected, so that
the crash can be fixed. Error traces are scrubbed of payload values. If
that is not good enough for your data, run
@attestwire/en16931 in your own process — it makes no network
calls at all, and that option exists precisely for this reason.
API keys
A key is generated, returned to you exactly once, and then hashed. We store only the SHA-256 hash. There is no reveal button and no recovery flow, because there is nothing on our side to reveal — if you lose a key, you create another one. Anyone who compromises our key store gets a list of hashes.
Metering is per key, held in a Cloudflare Durable Object, so the count is consistent without a shared database. The signup email address and your tier live in Cloudflare Workers KV. That is the complete list of what we hold about an account.
Infrastructure
Everything runs on Cloudflare Workers — the marketing site, the API, the free tools. There are no servers we administer, no SSH, no long-lived hosts to patch, and no VPN to leave open. Cloudflare terminates TLS; the API is HTTPS-only. State is limited to the KV and Durable Object stores described above.
Administrative access to the Cloudflare and Stripe accounts belongs to one person and is protected by multi-factor authentication.
Payments
Card data never touches us. Checkout and the billing portal are hosted by Stripe; you enter payment details on Stripe's pages, not ours. We hold a Stripe customer identifier and your tier. Nobody here can see a card number, because it never arrives.
Stripe never receives an invoice payload. It knows you are a customer; it does not know what you validate.
Where processing happens
This is the question EU buyers ask, and it deserves a precise answer rather than a comfortable one.
Cloudflare Workers executes your request at the point of presence nearest the caller. In practice, a request from Germany is normally handled inside the EU and never leaves it. We do not contractually guarantee that today. The routing is Cloudflare's and it is optimised for latency, not jurisdiction, so we will not print a residency promise we cannot enforce.
Cloudflare offers a product for this — Data Localization Suite, with regional processing controls. Adopting it is on the roadmap, and it is a roadmap item, not a claim. If contractual EU-only processing is a requirement for you, say so at hello@attestwire.com before you integrate; in the meantime the library runs entirely inside your own infrastructure, wherever that is, and sends nothing anywhere.
Attestwire itself is operated from the United States. Where personal data is involved, the transfer basis is covered in the data processing addendum.
Subprocessors
Two, and they do different jobs.
| Who | What for | What they touch | Where |
|---|---|---|---|
| Cloudflare, Inc. | Infrastructure | Everything the API receives, for the moments it is being processed. Signup email addresses and tier, stored in Workers KV. Per-key request counts, stored in Durable Objects. | Global edge network; the PoP nearest the caller. |
| Stripe, Inc. | Billing only | Your billing email and payment details, which you give to Stripe directly. Stripe never receives invoice payloads, and no card number ever reaches our code. | United States and Ireland, per Stripe. |
There is no analytics vendor, no error-tracking SaaS, no CRM, no marketing automation and no advertising network anywhere in this stack. The site sets no cookies and loads nothing from a third-party domain — see privacy. If we add a subprocessor, DPA customers get 30 days' notice before it starts processing.
What we do not have
Vendor questionnaires ask for these. The answers are all "no" today, and a "no" you can plan around beats a "coming soon" you cannot.
- No SOC 2. No Type I, no Type II, no audit in progress.
- No ISO 27001. Not certified, not in scope this year.
- No third-party penetration test. None has been commissioned. When one is, the date and the firm will be named here.
- No formal bug bounty and no disclosure platform — see below for what there is instead.
- No 24/7 on-call. One person, Pacific time. See response times.
What stands in for a certificate is the architecture: there is no invoice store to breach, keys exist only as hashes, cards never arrive, and the library gives you a supported way to use none of our infrastructure at all.
Reporting a vulnerability
Email hello@attestwire.com. The same address is published in /.well-known/security.txt per RFC 9116.
There is no bug bounty and no formal disclosure process: one address that reaches a person. Tell us what you found and how to reproduce it and we will answer — within two business days, usually faster. We will not threaten you, and we will credit you if you want to be credited. Please do not run automated scans against the paid endpoints or test with anyone else's invoice data.
Last updated . If this page changes materially we will say so here rather than silently swapping it.