Your data, kept safe

Invoices show who you pay, who pays you and how much. That is why CassaChiara is built so your invoices never pass through our servers.

Invoices stay on your device

• XML, .p7m and ZIP files are read inside your browser. We never upload them to a server.
• Companies you open are saved only on this device (in the browser's storage). To move them to another computer there is a backup file that you keep.
• You can delete a company or all data at any time, from the app or from your browser settings.

Fatture in Cloud: read-only

• The connection uses Fatture in Cloud's official sign-in (OAuth). We only ask for read permissions: CassaChiara cannot create, change or delete anything in your account.
• The access key is encrypted (AES-256) and kept in a cookie that page code cannot read (HttpOnly, Secure, SameSite=Strict). It expires by itself within 8 hours.
• You can revoke access at any time from your Fatture in Cloud settings, in the connected applications section.

Protection against malicious files and scripts

• All text coming from invoices (names, descriptions, IBANs, payment notes) is shown as plain text, never executed. We tested this with invoices crafted to attack the app.
• The site uses a strict Content Security Policy: the browser only runs code from cassachiara.com and one ZIP library checked by fingerprint (SRI). The site cannot be framed by other sites (except the free calculators, which are made for that).
• Always-encrypted connection (HTTPS with HSTS). No ads and no tracking tools.

Sign-in and payments

• No password to steal: you sign in with a passkey (fingerprint, Face ID, PIN) or with an email link.
• Payments go through Stripe: card details never reach us.

Found a problem?

Write to giuseppe@cassachiara.com: we reply and fix it right away. More details in the privacy policy.