Trust & Security
How CrateAPI actually handles your documents — the real architecture behind the API, in plain language. Not a wall of badges: this page tells you what we do, and, just as importantly, what we don't have yet.
Zero retention
The e-invoicing engine is stateless by design. We don't store the content of your invoices, orders or credit notes — a document comes in, gets processed, and the result goes back out. Nothing is written to a database.
Processed in memory
The live demos on this site work the same way: your file or text is held in memory for the length of the request and discarded once it's answered. There's no upload storage and no history of what you tried.
Zero LLM at runtime
Generation, validation and conversion are deterministic — driven by the official EN 16931, Peppol, XRechnung, FatturaPA, Facturae and KSeF schemas and business rules. Your invoice data is never sent to a language model to be processed.
Metering without content
We log API usage for billing — timestamp, endpoint, status code — with the caller identified by a hash of their API key, never the key itself and never the document content.
Hosted in the EU
CrateAPI runs on a server in Helsinki, Finland. Processing happens inside the EU — relevant if that's a requirement for your own compliance.
Encrypted in transit
Every request to crateapi.com and api.crateapi.com goes over HTTPS, with certificates renewed automatically. There's no plain-HTTP fallback.
Free validation, no account
Check any invoice against the official rules at the free validator without creating an account, entering a card, or giving us your email.
What we don't have — yet. We're a small, self-funded team. We don't hold SOC 2, ISO 27001 or PCI-DSS certification, and we're not going to imply otherwise. We also don't process payment card data ourselves — that's handled by our payment provider — so PCI-DSS scope doesn't apply to what we build. If formal certification becomes something our customers actually need, we'll pursue it. Until then, this page and the practices behind it are what we can honestly stand behind.
Security question, or found something?
Email us directly — contact@crateapi.com. No ticket system, no bot in between.
Want to see it for yourself?
Every claim on this page is backed by the same API you can call today — read the docs, or try the free validator with your own invoice.