Where your data lives
Residency is two questions: where the data sits, and where the code that reads it runs.
The primary database and the private file storage are hosted on Supabase in the Zurich region (eu-central-2): invoices, clients, expenses, receipts, documents and signed contracts.
The application runs elsewhere: serverless code on Vercel in Frankfurt (fra1), reading that database in Zurich. Email, the AI features and - only with consent - website analytics process limited data in the EU or the US.
Who can reach your rows
Every module is account-scoped: a read or a write resolves an account id first and every query filters on it. Under that sits row-level security - 444 policies at a September 2026 measurement - so an account reaches only its own rows.
Background jobs run under a service-role client that bypasses row-level security by design, SECURITY DEFINER functions run as their owner, and FORCE ROW LEVEL SECURITY is set on zero tables. Those paths are closed in the application layer instead, which is why no page here says the database physically cannot return another tenant's row.
Solory is operated by one person, who can open an account to answer a support request or investigate a fault. That writes a record into the account's own audit log, limited to what the question needs. Nobody else has access, and the audit log cannot be edited or deleted by either side.
Two-factor authentication, and why it is more than a screen
TOTP through an authenticator app, under Settings and Security.
Enrol
Scan a QR code or type the secret into your authenticator app, then confirm with a 6-digit code.
Keep the recovery codes
Single-use, shown once, with copy, download and regenerate. Using one switches 2FA off and says so.
Sign in
A step-up challenge follows the password, rate limited so repeated attempts are refused.
A restrictive database policy is combined with every existing policy on 160 tables, and it reaches file storage too - receipts, signed contracts, documents, mail attachments. A session that has not completed the factor does not get the data, not merely the page.
What a team member, an accountant or a client can see
Four kinds of access, four ceilings. None of them is everything.
| Who you let in | What they see | What they cannot reach |
|---|---|---|
| Team member on a shared account | Everything in the shared account, and they can manage it | Another person's profile and email signature |
| Accountant (Treuhänder) | Invoices, expenses and the financial summary, read-only | Any edit at all - the access can never write, and it is revocable |
| Subcontractor on one project | That one project, in order to log their own hours | Your rates, your invoices, every other project |
| Client, on a portal link | Their own sent invoices, sent estimates and linked documents | Drafts, unsent estimates, anything of another client's |
Portal and signing links store only a SHA-256 hash of the token, hand the usable URL over once, expire on a validity you choose, and are revoked when regenerated. The subcontractor limit is enforced by a database function, not a hidden button.
Subprocessors, and which ones are off by default
Nine in total: five the product needs, four that do nothing until you connect them.
| Subprocessor | What it does | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | Zurich (eu-central-2) |
| Vercel | App hosting, serverless compute, CDN | Frankfurt (fra1), global edge |
| Mailgun (Sinch Email) | Mail on your own verified domains, open and click tracking | US, EU region available |
| OpenAI | Assistant, drafting, document reading, expense categorisation | US - API data not used to train models |
| Stripe | Subscription payments and card processing | EU / US - never your business records |
| Google Analytics | Measurement on public pages, only with consent | EU / US - no account or client content |
| Google Calendar | Only if you connect it: the events you sync | EU / US |
| Telegram | Only if you connect the assistant: the messages exchanged | Outside Switzerland and the EU |
| Discord | Only if you configure a notification webhook | US |
OpenAI is the AI subprocessor. The assistant reads and drafts, shows a plan you can read first, and runs only after you confirm - it never sends mail or changes a record on its own. The optional reply-drafting feature writes a draft marked pending that a person approves.
Getting your data out, and getting it deleted
Both are self-service, under the right of access and data portability in the revised Swiss data protection act (revDSG, in force since 1 September 2023).
- A ZIP with one structured JSON document and a README, from Settings and Privacy
- A short-lived download link, with its life stated on screen
- A section that could not be read is listed in the archive, and the copy is marked incomplete
- One archive per account, because each run writes a full unredacted dataset
- Sealed invoices and contracts travel with it
Deletion is a request with a 30-day grace period, cancellable throughout. It is refused while sent or overdue invoices are unpaid, naming which to settle first. On expiry the sign-in is permanently disabled, files, stored credentials and connected channels are deleted, and the rest is irreversibly anonymised.
A failed step leaves the request open and retried. You will not be told your data is gone while any of it is not.
Backups, incidents and the status page
Backups are rotated and overwritten on a regular cycle. No recovery point objective, recovery time objective, backup frequency or restore-test cadence is published, because none is defined. If your risk assessment needs those figures, they do not exist - the self-service export is there so you can hold your own copy.
A personal-data breach is notified without undue delay after it becomes known, to the account email address, so you can meet your own duties towards the FDPIC and the people affected.
The public status page lists the service components with 90-day uptime bars, an incident timeline and scheduled maintenance. The bars come from incidents actually recorded rather than a chosen figure, which also means no availability commitment stands behind them.
What Solory does not claim
The useful half of a security page is the half that says no.
- No ISO 27001, no SOC 2, no published penetration test, no third-party security audit.
- No encryption-at-rest claim. The published measure is encryption in transit (TLS/HTTPS), with private files behind short-lived signed links.
- No uptime SLA, no recovery point objective, no recovery time objective.
- No mandatory two-factor authentication - it is optional, per user, and off until switched on.
- No autonomous AI. The assistant drafts and asks for confirmation, and cannot send an email on your behalf.
- No complete erasure. Accounting records, signed contracts, the scrubbed audit log and the deletion request outlive the account.
- Not double-entry bookkeeping and not a replacement for a Treuhänder. It produces an Erfolgsrechnung from cash and invoice data; a person files.
Questions people ask
Where is my Solory data stored?
The primary database and the private file storage are hosted on Supabase in the Zurich region (eu-central-2), covering invoices, clients, expenses, receipts, documents and signed contracts. The application itself runs as serverless code on Vercel in Frankfurt (fra1) and reads that database. Email, the AI features and consent-based website analytics process limited data in the EU or the US, so "your business data is in Switzerland" is accurate while "everything is in Switzerland" is not.
Is my data encrypted?
In transit, yes: TLS/HTTPS across the service and its subprocessors, and private files are reachable only through short-lived signed links. No encryption-at-rest claim is made, because no such measure is specified and documented, and inventing one on a marketing page would be worse than naming the gap. If encryption at rest is something you have to evidence to a client, treat it as an open question and ask first.
Can anyone at Solory see my client data?
Solory is operated by one person, who can open an account in order to answer a support request or investigate a fault. Doing so writes a record into that account's own audit log, which the account holder can read, it is visible on screen while it lasts, and it is limited to what the question needs. Nobody else has access, and the audit log cannot be edited or deleted by either side.
Does two-factor authentication protect the data or only the login screen?
Both. Enrolment is TOTP through an authenticator app with single-use recovery codes, and beyond the sign-in challenge a restrictive database policy sits on 160 tables and on file storage, so a session that has not completed the factor does not reach the rows or the files. It is optional and per user, which means it protects your account only once you switch it on.
Does the AI assistant do anything without me?
No. It reads your records and drafts, it shows a plan you can read, and it runs only after you confirm, re-checking every reference against your own data at that moment. There is no step in what it can be confirmed to do that sends an email or a message, and the optional reply-drafting feature for incoming mail writes a draft marked pending that you approve before anything leaves.
What happens to my data if I delete my account?
The request carries a 30-day grace period during which it can be cancelled, and it is blocked while there are unpaid sent or overdue invoices, naming the ones to settle first. When the period expires the sign-in is permanently disabled, files, stored credentials and connected channels are deleted, and the rest is irreversibly anonymised. Accounting records survive ten years from the end of the financial year under OR Art. 958f, signed contracts stay with their signature evidence, and backups are reached on their ordinary rotation cycle within a few weeks.
Is Solory ISO 27001 or SOC 2 certified?
No. There is no ISO 27001 certification, no SOC 2 report, no published penetration test and no third-party security audit, and nothing on this site implies one. What exists instead is written down and checkable: Swiss hosting for the database and the files, row-level security with its exceptions named, optional two-factor authentication that reaches the data and not only the screen, an audit log nobody can edit, and self-service export and deletion.