Data storage, privacy and account deletion
Where data is stored
Account data is stored in data centers in Frankfurt, Germany, with encrypted backups in Dublin, Ireland. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
GDPR
Quillstack acts as a data processor for your client data. A Data Processing Agreement is available to sign in Settings → Data → DPA. The list of sub-processors is published on the trust page and you can subscribe to change notifications.
Delete your account
The owner can delete the account in Settings → Data → Delete account. After a 14-day grace period all data is permanently deleted, including backups after a further 30 days. Invoices you are legally required to keep should be exported first, because deleted data cannot be restored.
Card data
Quillstack never stores full card numbers. Card details are handled by Quillpay, which is PCI DSS Level 1 certified.