Security: what we do, and what we don't claim.
No certifications we don't have. Below is how the system works, where your data lives and what the AI does and doesn't get to see.
Where your data lives
The starting point: the workflow and your data sit at your company. Only the text the AI needs to read or write goes to an AI model. For payables, that text passes a privacy filter first. For receivables, the model runs in your own Azure account.
| Data | Where |
|---|---|
| Invoices, PDFs, database and audit log | On your own server or in your own cloud environment |
| Accounting | Stays in your own ERP, for example Exact Online. We read and book through the official connection. |
| Email and drafts | In your own Outlook or Microsoft 365 |
| Text the AI processes | Payables: after the privacy filter, to Claude (Anthropic), or another model on request. Receivables: Azure OpenAI in your own Azure account, in an EU region. |
| Management by Spin Automation NL | Remotely, over an encrypted connection. We keep no copy of your data. |
What the AI does and doesn't see
For accounts payable, personal data is filtered out of the invoice before the AI reads anything. Invoices from sole traders don't go to the AI at all; a person handles them.
For accounts receivable, the AI needs your customer's name and the open amounts to write a personal email. It gets nothing more.
What the AI doesn't do
- Decide: fixed rules do that, and a person on exceptions
- Send emails: reminders are prepared as drafts
- Search the internet or change anything in your ERP
- Write the final notice: that text is fixed
Which AI model, and where does it run?
By default we use Claude from Anthropic through its business API. That processing is currently not guaranteed to take place in the EU. The transfer is covered by Anthropic's data processing agreement with standard contractual clauses, and data sent through the API is not used to train models.
Does everything have to stay in the EU? Then we use Azure OpenAI in an EU region, or Claude through an EU region at AWS or Google Cloud. For accounts receivable, Azure OpenAI in your own Azure account, in an EU region, is already the default. The workflows stay the same, only the model changes.
Recording and checking
For payables, every decision is recorded: who, what and when. So you can see afterwards why an invoice was booked or stayed on hold.
Built-in checks
- Supplier, VAT number and IBAN are checked against your records
- Duplicate invoices are detected
- Credit notes always go past a person
- Approval links work only once
Access and technology
You decide who has access to your environment. We only log in for management and maintenance.
- Connections to Exact Online and Microsoft 365 via OAuth: you grant access and can revoke it
- Passwords and keys stored encrypted, never inside the workflows
- All connections over HTTPS
- Database backups, set up for your environment
GDPR
You are the data controller. For management we are the processor, and we sign a data processing agreement with you for that. It also lists which AI model is used as a sub-processor.
If we notice a security incident, we report it to you right away, so you can notify the Dutch Data Protection Authority within 72 hours if needed.
What we don't claim
What we don't claim. We don't hold ISO 27001 or NEN 7510 certification and don't give an uptime guarantee. If you work in healthcare and certification is a requirement, talk to us. Together we'll look at what your own IT environment already covers.
Frequently asked questions
Where does the AI run?
For accounts payable it is Claude by Anthropic, after the privacy filter, and not guaranteed in the EU. For accounts receivable it is Azure OpenAI in your own Azure account, in an EU region. If everything has to stay in the EU, that is possible for accounts payable too.
Is my data used to train AI?
Data sent through the Anthropic API is not used to train models.
Do you have access to my systems?
You decide who has access. We only log in for management and maintenance, over an encrypted connection, and we keep no copy of your data.
What do I keep if I stop?
Everything. You export the workflows as JSON and the database as a standard SQL export.
Are you ISO 27001 certified?
No. For a firm our size, ISO 27001 or NEN 7510 certification is not a good fit. The automation runs on your own server or in your own cloud account, so it falls under your own security policy. How we handle access, passwords and logging is described on this page. We give no uptime guarantee, because availability depends on your own server or hosting provider. If certification is a requirement for you, talk to us.