Compliance
faktoora operates an information security management system (ISMS) aligned with leading international standards and regulatory frameworks. Our compliance programme is documented in more than 30 interlinked policies, procedures and framework mappings, which are reviewed at defined intervals.
Data Protection
GDPR
Status: Implemented – continuously improved
As a German company that processes personal data of individuals in the EU, faktoora has implemented a GDPR programme:
- An external data protection officer (PROLIANCE GmbH)
- A documented record of processing activities
- Defined procedures for data subject requests, with self-service export and editing in the application
- Data processing agreements (Art. 28 GDPR) for our business customers
- Privacy-by-design principles in the development process
Details can be found on our Privacy page.
Operational Resilience and Cybersecurity
DORA
Status: Processes aligned with DORA
The Digital Operational Resilience Act (DORA) applies to financial entities and governs how they manage their ICT service providers. faktoora has aligned its processes with DORA:
- ICT risk management framework with defined governance
- Procedures for classifying and reporting incidents, aligned with the DORA deadlines
- Business continuity and disaster recovery plans with a defined testing programme, including a documented restore exercise
- Third-party risk management including concentration risk assessment and exit strategies
- A digital operational resilience testing programme
NIS2
Status: Aligned
Our security measures are mapped to the risk-management measures of the NIS2 Directive, including risk analysis, handling of security incidents, business continuity, supply chain security and the use of cryptography. In doing so, we are guided by the German implementation of the Directive (NIS2UmsuCG).
Information Security Standards
ISO 27001
Status: ISMS aligned with ISO/IEC 27001:2022
Our information security management system is aligned with ISO/IEC 27001:2022 and is supported by a Statement of Applicability covering all 93 Annex A controls. Our ISMS covers:
- Information security policies and governance
- Access control and identity management
- Cryptography and key management
- Operations security and change management
- Secure development process
- Supplier and third-party risk management
- Incident management and business continuity
- Human resource security
Our hosting provider's data centres are ISO 27001 certified.
SOC 2
Status: Controls mapped
faktoora's security measures are mapped to the SOC 2 Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy.
C5 (BSI)
Status: Controls mapped
Our measures are mapped to the basic criteria of the BSI C5:2020 (Cloud Computing Compliance Criteria Catalogue), the German federal standard for the security of cloud services.
Artificial Intelligence
EU AI Act
Status: Assessed
We have assessed all AI-assisted features against the EU AI Act. None of them falls into a prohibited or high-risk category. AI-assisted features are optional and support users in their work – they do not make decisions in their place. The AI services we use are listed on our Service providers and recipients page.
E-Invoicing Standards
faktoora is built to comply with European e-invoicing regulations:
| Standard | Scope |
|---|---|
| EN 16931 | European standard for electronic invoices – core conformance |
| ZUGFeRD | German hybrid PDF/XML invoice format (CII-based) |
| XRechnung | German e-invoicing standard (mandatory for B2G) |
| Peppol | Pan-European e-invoicing network, connected via our own Access Point |
| VeriFactu | Invoice registration with the Spanish tax authority |
| KSeF | National e-invoicing system in Poland |
| E-invoicing France | Transmission via a state-approved French e-invoicing platform (Plateforme Agréée) |
German Commercial and Tax Law (GoBD)
faktoora supports you in GoBD-compliant invoicing and your own archiving, among other things through:
- Tamper-evident audit trails with cryptographic integrity checks
- Tamper-evident storage of your documents during the contract term and complete export for your own archiving
- Invoice integrity from creation to export
- Complete, traceable processing records
Contractual Documents
Our contractual commitments are published on our website:
Detailed Documentation
For access to detailed compliance documentation, including policy texts and control mappings, please visit our Request Access page.
Questions?
For compliance enquiries, please contact compliance@faktoora.com.