Data Processing Agreement

Roles

For customer-uploaded invoice and supplier data, the customer is typically the data controller and Invogi acts as data processor.

Customer instructions

Invogi processes customer personal data only to provide and secure the service, according to the customer's documented instructions in the agreement, product configuration, and authorized support requests, unless applicable law requires otherwise.

Security and confidentiality

Invogi limits access to authorized personnel and subprocessors subject to confidentiality obligations and maintains technical and organizational safeguards described on our Security & Trust page.

Sub-processors

Sub-processor	Purpose
Cloudflare	Object storage, edge compute, and opt-in Workers AI document processing
Managed PostgreSQL provider	System of record
Microsoft Azure	Opt-in Document Intelligence processing for eligible invoice documents
Clerk	Authentication and account identity
Resend	Organization invitation email delivery
Paddle	Subscription billing, EU VAT

Data subject requests

Erasure requests are handled per our retention policy: personal data in append-only audit/finding evidence is pseudonymized in place; source documents are hard-deleted. Contact us to initiate a request.

Incidents, audits, and deletion

Invogi will notify affected customers without undue delay after confirming a personal-data breach, provide information reasonably needed for compliance, and make relevant security information available on reasonable request. At the end of service, customer data is returned or deleted according to the agreement and configured retention, except where law requires continued storage.

International transfers

Where a restricted international transfer occurs, the parties will use an applicable lawful transfer mechanism, including standard contractual clauses where appropriate. Contact support to request a signed DPA or current transfer details.