Security at NoticeDesk
How we look after the invoices and account data you trust us with: in plain English, and only claims we can stand behind. The Privacy Notice is the legal companion to this page.
Last updated: 28 September 2026
Where your data lives
The application runs in London and the database in Frankfurt, EU. Rate-limit and lookup caches are held in London. AI extraction is processed by our AI provider, currently in the United States. That transfer runs under the provider's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. All traffic is encrypted in transit, and access to production systems is restricted. The providers themselves are listed in our Privacy Notice.
Your workspace is isolated
Every read and write is scoped to your workspace by the application, and an automated test blocks our release if any query is written without that scope. Inside a workspace, four roles keep duties separated: owner, admin, member and viewer. Viewers can read but never change an invoice, and billing actions are restricted to owners and admins.
Signing in
NoticeDesk uses one-time email codes instead of passwords. There is no NoticeDesk password to phish, guess or reuse from another site. You stay signed in on the devices you choose; signing out revokes your sign-in everywhere, so a signed-out session can't be renewed. Signing in with a new email address creates your own workspace on the spot, and no one joins it until you invite them.
Everything leaves a trail
Every invoice keeps a timeline (extracted, checked, edited, exported), and its per-invoice evidence CSV lists every change: the old and new values, and the signed-in user who made it. Events are recorded best-effort and the CSV says so; an absent event is never treated as proof. Security and audit logs are retained for up to 7 years, for security and because they support our customers' HMRC record-keeping, then deleted.
Files and AI processing
Every uploaded file is validated by its content, not its filename, before any processing: a mislabelled or malformed file is rejected up front. Uploaded files are deleted from our servers after successful processing; if an extraction fails, the file is kept so the failure can be diagnosed, then removed under our retention schedule (currently up to 90 days). Under our AI provider's paid-tier terms, your content is not used to train its models, and we do not permit it to use your documents for training.
Payments
Your card number never reaches NoticeDesk. Payments are taken by our payment provider, which acts as the merchant of record. We receive subscription status, plan and transaction records, never your full card number. The provider's payment notifications can also carry partial payment details (a card's type, last four digits, expiry date and cardholder name, a wallet account's email address and billing agreement reference, or which local card or wallet paid); we remove those before anything is stored.
Sub-processors
We use a small set of providers to run the service, each under a data processing agreement. The full list is in the Privacy Notice. Every provider on it is one we use today, and the list is updated before a new one is added.
What we claim, and what we don't
Every claim on this page is one we can show you the mechanism for. We name no certifications we don't hold. The product presents its checks as evidence rather than a verdict: an invoice is reported as having "no defects found", not "valid", because the second is your judgement to make. And when a check can't be completed (a register lookup that fails or times out, for example), it reports unverified instead of guessing.
Report a concern
If you find something that worries you (a vulnerability, or just odd behaviour), email [email protected] with "security" in the subject line and it goes straight to the people who built the product. If you're not sure whether it matters, send it anyway.