How Invoq keeps your data safe

Can Invoq file my VAT return without me?

No. Invoq prepares your KMD and sends it to e-MTA as a draft through X-tee, the state's secure data exchange. The return is only filed when you review and confirm it in e-MTA yourself. How to give Invoq that access is explained in Enabling Automatic e-MTA Submissions in Invoq.

How does company verification work?

Before Invoq can send anything to e-MTA or register your company for e-invoicing, the company has to be verified. Invoq gives you a one-time reference code, and you send €0.01 with that code in the payment description. The payment can come from the company's own bank account or from a board member's personal account, and in both cases it must be an Estonian bank account. When the payment arrives, Invoq checks the payer's code as reported by the bank: the registry code must match your company, or the personal ID code must belong to one of the company's board members in the Business Register.

Once the company is verified, its registry code is locked in Invoq. Changing it afterwards goes through our support.

Is my data used to train AI?

No. Neither Invoq nor the AI provider we use trains AI models on your documents. The provider's terms forbid it without our permission.

Invoq does remember how your company books. When you book a purchase invoice, the VAT treatment and account you chose are saved for that supplier. The next single-line invoice from that supplier starts with them; for longer invoices, the AI uses the saved account as a hint. Invoq also keeps a short summary of your bookings: which kinds of cost and which suppliers went to each account. It is updated each time you book a purchase invoice or receipt, and the AI uses it when suggesting accounts. Both are kept per company and only used for your company's documents.

To read and book your documents, the AI provider receives:

• to read a document: the file itself, plus your company name, VAT number, registry code and the description of your business from your settings;
• for VAT and account suggestions: the details read from the invoice, your company name and business description, your chart of accounts and the summary of your past bookings;
• when you book a purchase invoice or receipt: the line descriptions and the supplier name, to update that summary.

The provider processes these requests on its worldwide network, so we don't promise the processing happens inside the EU. It may keep a temporary copy for up to 24 hours to answer faster. If its automated safety checks flag a request, it may keep it for up to 90 days for review. Neither copy is used for training.

Where is my data stored?

The Invoq app, its database and your uploaded invoice and receipt files are hosted in the EU. E-invoices you receive are kept in the same database. Both the database and the files are encrypted on disk. The database is backed up every day, and each backup is kept for 6 days.

E-invoices you send and receive go through Billberry, an Estonian e-invoice operator.