Security and privacy
You upload invoices and timesheets. Here is plainly what happens to them.
✓Uploaded documents are never stored
Invoices, photos and scans are held in memory only for the duration of the check. They are never written to the server’s disk. Close the page and nothing is left.
✓Only what you type in is stored
Company profile, supplier list, hours record and a summary of past checks. No images and no PDF documents.
✓Each company’s data is kept apart
Every company has its own folder that only the application itself can enter. One company’s account cannot reach another’s data — a path check enforces this in two independent places.
✓Nothing goes to third parties
Text recognition from photos runs on this same server. No external API, no cloud, no language model on the internet. Sumly has nowhere to send your documents because it connects nowhere.
✓Encrypted connection, password stored only as a hash
The site runs over HTTPS. Passwords are stored as a hash (scrypt) — the original cannot be recovered from it, not even with access to the server. After five failed attempts the account locks for fifteen minutes.
✓The server is in Frankfurt
Germany, so the European Union. The data does not leave the EU.
✓The data is yours — available and deletable at any time
Excel export is built into the app. To delete your account and all data, a message to the operator is enough; it is really deleted, not just hidden.
!Backups are still on the same server
Backups run nightly and are kept for 14 days. They sit on the same machine, though — if the provider lost it, the backups would go with it. Your invoices are always in your own accounting as well; what would be lost is the hours record. An off-server copy is being prepared.
team@sumly.eu
sum/y.For firms that re-invoice hours worked — agencies, subcontractors, staffing companies.
What Sumly does
- Checks outgoing invoices against timesheets and incoming invoices.
- It corrects nothing and sends nothing. The decision stays with a person.
Documents and security
- Uploaded documents are never written to disk.
- Text recognition runs on our server, not at a third party.
- Server in Frankfurt am Main (EU).
- Deletion of all data on request.
© 2026 Sumly · All rights reserved.