Create your marta®
← Home The project What it does How it works Freelance Contact English Български Italiano Create your marta®

Last updated · 1 November 2026

Data anonymisation and security

Your company's data stays yours. Three rules: the artificial intelligence never receives real names, IBANs or emails; each company has its own separate space; what we don't need, we don't keep.

1. The filter that protects your data

When a marta® feature uses artificial intelligence (reading a document, suggesting a reconciliation, answering a question), the text first goes through a filter that runs on our servers. These are the steps:

How the anonymisation filter worksFive steps in sequence: your data, the filter that replaces it with placeholders, the leak check that stops the request if anything sensitive is left, the artificial intelligence model that only sees placeholders, and the answer that comes back to you with the names put back in place on our servers.1Your datanames, IBANs, emails, addresses, amounts2Anonymisation filterreplaces personal data with placeholders3Leak checkif anything sensitive is left, therequest stops4Artificial intelligence modelsees only placeholders: [AZIENDA_1],[IBAN_1]5The answer comes back to younames are put back in place, on ourservers
Steps 1, 2, 3 and 5 happen on our servers. The model only receives text without personal data.
An example Before: Transfer to Alfa Servizi SRL, IBAN IT00 X000 0000 0000 0000 0000 000, contact Mario Rossi, [email protected], 1,250.00 EUR
After: Transfer to [AZIENDA_1], IBAN [IBAN_1], contact [PERSONA_1], [EMAIL_1], 1,250.00 EUR
  • What we replace: names of companies and people, emails, phone numbers, addresses, IBANs, VAT numbers and tax codes.
  • What stays readable: amounts, dates, currencies, invoice numbers and categories: they are needed to reason.
  • When in doubt we mask more. If anything sensitive is left after the filter, the request is not sent.
  • Stable placeholders: the same company always gets the same placeholder, even when written differently, so the model can reason without knowing who it is.
  • No content in the log: we only keep counts, outcome and duration of each call, never the text.
  • No training: your data is not used to train third-party models, unless you explicitly agree.
  • Files: PDFs and images are first read locally and then filtered.

No filter is perfect: a name written entirely in lower case inside free text may slip through if it is not among your already known customers and suppliers. That is why the dictionary of your records is always applied and, when in doubt, the filter masks more, never less.

2. Where and how we store data

  • A separate space for each company: its own database and file folder, not shared with other companies.
  • Servers in the European Union.
  • Access with a personal account, different roles (owner, collaborator, accountant) and optional two-step verification, which we recommend.
  • Passwords are never stored in clear: we only keep a protected fingerprint.
  • A log of operations on what is changed.
  • Daily backups, kept for 30 days and accessible only to administrators.
  • Your data, your control: export everything as a ZIP archive whenever you want; when you close the account we delete it permanently after a short retention period.
  • Never sold, never used for advertising.

3. Encryption

What is encrypted today, and what we are introducing.

Already active

  • In transit: every connection uses HTTPS (TLS), with HSTS.
  • Passwords: protected with scrypt, a method designed to resist brute-force attempts.
  • Access keys: two-step verification secrets and tokens of connected services (for example Google) are encrypted with AES-256-GCM.
  • Backups: encrypted with AES-256-GCM before being written to disk.

Coming

  • Databases and files at rest: encryption of databases and of the file folder, being designed: we will publish it here once it is active.

4. If something goes wrong

If we ever notice a personal data breach, we will notify it as required by Articles 33 and 34 of the GDPR: to the competent authority within 72 hours and to the affected customers without delay. For questions write to [email protected]. For details read the privacy policy.

Back to home