Security and privacy

Hosted and managed by Assist2go

Avsaro runs on servers of Assist2go. We look after hosting, updates and support, so you have nothing to set up yourself. We run updates at night whenever we can, so you do not notice them during your working day.

Logging in and sessions

You log in with your email address and password and then always confirm with a code from an authenticator app. This two-step verification is mandatory. The code is six digits long, is valid for 30 seconds and cannot be used twice.

• Commonly used passwords are refused.
• You get ten one-time recovery codes in case you lose your phone. They are stored only as a hash.
• A session lasts at most 12 hours and ends after 120 minutes without activity. You can have at most ten sessions open at once and end other sessions yourself under Account.
• A limit on login attempts applies per account and per network. A lockout is written to the audit log.

Connection secrets and what you can review

The two-step secret and the secrets of connections, such as the Mollie access token and the certificate for Microsoft 365, are stored encrypted with AES-256-GCM in the database. The keys for this are kept apart from the database. Recovery codes and client link tokens are stored only as a hash, so they cannot be read back.

The audit log records when someone logged in, when a password or two-step verification was changed and when settings, connections or archiving were changed. Passwords and secrets never appear in it. For an IBAN or phone number only the last four characters are in the log.

Client links and evidence

Your client opens a quote or invoice through a personal link with a long, random token. Without that link there is nothing to see, and the pages are not meant to be found by search engines. Client links have a limit per link and per network, against guessing addresses.

When a client accepts a quote, Avsaro records an evidence file: name, role, time, the text shown, the signature and fingerprints (SHA-256) of the quote and the terms. Database rules make those rows unalterable, and a hash chain shows whether anything was changed. Anyone can check on the verification page whether a document is genuine.

It is a simple electronic signature with that evidence file. Read the guide on the validity of a digital signature for what that means.

Keeping and erasing

You set the retention periods yourself, with a lower limit. Invoices are kept for at least 7 years, and you can extend that to 30 years. That is a lower limit in line with the Dutch tax retention obligation and is not legal advice. Check with your accountant what applies to you.

• Invoices, numbered quotes, payments and evidence are not deleted. You can archive them, with a reason, and you can undo it.
• After the period you set (12 months by default) the technical data of an acceptance is erased: IP address, browser, time zone and language. The acceptance itself stays.
• Confirmation codes, used recovery codes and expired sessions are cleared daily.
• In the certificate of new signed pdf files the IP address is shortened to the network block.

Privacy and GDPR

Avsaro is built with the GDPR in mind. Personal data does not end up in log files. In presentation mode all names, addresses, bank details and amounts are replaced by invented values, and write actions are refused. That lets you show Avsaro to a client without showing your own records.

For the personal data of your clients you are the controller and Assist2go is the processor. We put a processor agreement in writing with you when you start.