.png){kind=icon}
Security & Privacy of AI Connect
The path your data takes, what is and isn't stored and who can access it. For entrepreneurs and accountants who connect their bookkeeping, including to an AI assistant.
- Nothing changes in your administration without your approval
- Data processed and stored encrypted within the EU
- ISO/IEC 27001:2022 certified and independently pentested
ISO/IEC 27001:2022 · certificate number TA-01-CCBV-260924
From question to answer
in six steps
AI Connect is a secure layer between your AI assistant and your accounting system. The assistant does not talk to your administration directly. Every question goes through the connector, which checks what is allowed.
You and your AI assistant
Claude, ChatGPT, Copilot or Gemini. You ask a question in plain English.
AI Connect
Translates your question into a request to the official API of your accounting system.
Your accounting system
Exact Online, AFAS or Twinfield. Answers through the official API or connectors, within the permissions of your own account.
Retrieved live, not stored
A question about an invoice, order, customer or balance? The connector retrieves the figures from your accounting system at that moment and does not store them afterwards. We only record which action was carried out, when and by whom.
Stored encrypted for fast analyses
For analyses across large numbers of transactions, such as margins, trends and comparisons per period, each administration has its own encrypted dataset in the EU, just like a reporting tool such as Power BI. It is deleted when the trial period ends or after deactivation.
Clear boundaries, built into the connector
Now you know how a question flows. These are the five concerns customers raise with us most often, and how the connector covers them.
Changes only with your approval
A write action (entry, invoice, contact) is first presented to you and only carried out after your approval.
Processing and storage within the EU
AI Connect and all storage run on servers within the EU, in the Amsterdam region.
Your data is used only for your question
We do not train AI models on it and do not share it with third parties.
Access stops the moment you revoke it
Revoke the authorisation in your accounting system and the connector no longer has access to your administration.
Your password stays with you
We only store an encrypted access token, not your login details.
How we protect your data
Behind the connector is a complete security programme in line with ISO 27001. It applies to all our connectors, from webshop and bank to AI.
Three safeguards
Official connection
Exclusively through the official API or connectors of Exact Online, AFAS or Twinfield, with your own authorisation. Your accounting system therefore applies its own permissions, so nobody can see or do more through the connector than in the system itself. iWebDevelopment is an official partner of all three.
Data minimisation
For single questions your figures are retrieved at that moment, within your permissions, and not stored afterwards; for the audit logs we only record which action was carried out, when and by whom. For analyses (Analytics) each administration has its own encrypted dataset in the EU, which is deleted after deactivation.
No training
We only use your data to answer your question. We do not train AI models on it and do not share it with third parties.
Agreements
The data processing agreement is part of our terms and conditions (articles 16 to 27) and takes effect immediately with the trial period or the plan, so nothing needs to be signed separately.
Certificate and terms
Is your IT department or accountant assessing AI Connect? Here you will find our ISO certificate, its verification via UKAS and the terms and conditions with the data processing agreement.
ISO/IEC 27001:2022, certificate number TA-01-CCBV-260924. Scope: Provision of integration solutions to connect webshops, marketplaces, AI, CRM, and banks with their accounting software on a global scale.
Security is a joint effort
AI Connect is set up securely on our side. With these four steps you make your side just as strong.
- TIP 01
Business AI plan
Use a business plan for your AI assistant and switch off the use of your conversations for training.
- TIP 02
Limit write permissions
Only give write permissions to those who really need them. Read access is enough for most colleagues.
- TIP 03
Turn on two-factor authentication
Turn on two-factor authentication for your accounting system and your AI assistant.
- TIP 04
Clean up access
Revoke access when someone leaves the company and record who manages the connector.
Four layers that keep you in control
Around your administration are four layers that you control yourself. Together they determine what the connector may do, and show what has happened.
You approve every change
Retrieving and analysing is read only. A write action (entry, invoice, contact) is first presented to you and only carried out after your approval.
Permissions and limits per user
In the control panel you decide per person what is allowed: restrict write actions, block deletion and set a daily limit.
Your own authorisation, revocable at any time
You authorise the connector yourself in your accounting system. It gets no more permissions than you have. Revoke access and it stops immediately.
Always visible in the logs
In the activity logs you see which actions were carried out, when and by whom. We do not store the content itself (your question and the retrieved figures).
Frequently asked questions
No. We only use your data to answer your question. We do not train AI models on it and we do not share it with third parties.
With the AI assistant you choose yourself, such as Claude, ChatGPT, Copilot or Gemini, under your own account and the terms of that provider. AI Connect is only the secure connection between your AI assistant and your accounting system. That connection and all storage at iWebDevelopment run within the EU.
Only what is needed to answer your question, within your permissions. For individual questions your figures are retrieved at that moment and not stored afterwards; we only record which action was carried out, when and by whom. With the Analytics plan each administration has its own encrypted dataset in the EU, so that analyses across large numbers of transactions run quickly.
Not without you. Retrieving and analysing is read only. A write action (an entry, invoice or contact) is first presented to you and only carried out after your approval. In the control panel you can also switch off write actions entirely per user, block deletion or set a daily limit, and the connector has no more permissions than you have in your accounting system yourself.
Yes. In the control panel you can switch off write actions entirely per user, block deletion and set a daily limit. On top of that the connector gets no more permissions than the user has in your accounting system.
No. Each user connects their own account from Exact Online, AFAS or Twinfield. The connector takes over those permissions and adds nothing to them. In the control panel you can restrict things even further per user.
No. You authorise the connector through the official authorisation of your accounting system. We only store the access token your accounting system then issues, encrypted with AES-256, not your password.
You can revoke the authorisation yourself at any time from your accounting system or your control panel. Access then stops immediately. Do this as well when a colleague leaves the company.
In the activity logs you can see which actions were carried out, when and by whom. We do not store the content itself (your question and the retrieved figures).
The encrypted dataset of your administration is removed after the trial period ends or after deactivation.
The connector, the database, the data warehouse and the back-ups run on servers within the EU (Amsterdam region). iWebDevelopment does not transfer any data outside the EU.
The data processing agreement is part of our terms and conditions (articles 16 to 27) and takes effect immediately with the trial period or the plan, so nothing needs to be signed separately.
Yes. AI Connect has been independently audited and penetration tested for security, and falls within the scope of our ISO/IEC 27001:2022 certificate.