Privacy Notice

Client portal users

If your accountant invited you to the COHESORA client portal, COHESORA stores your name, e-mail address, password hash, optional MFA secret (encrypted), sign-in history, the documents and messages you send and when you open them — on your accounting firm's behalf. Your firm is the controller for this data. See Client portal terms.

1. Who is responsible

For data that accounting firms place in COHESORA about their clients and staff, the firm is the controller and INVICTT AI is the processor (see the DPA). For account and usage data of the people who sign up (name, work email, role, sign-in records), INVICTT AI is the controller. Entity: INVICTT AI. The legal entity name, registration number and registered address are not yet published and must be added before these documents can take effect.

2. What COHESORA stores

• Account data: name, email, password hash (scrypt), role, multi-factor secret (encrypted), sessions (IP address and browser identifier).
• Firm data entered by the firm: clients, contacts, engagements, tasks, uploaded documents (e.g. supplier invoices), extracted fields, notes, team invitations, audit trail.
• Operational data: email delivery records, background-job records, security events such as throttling (identifiers are stored as keyed hashes), and server logs with request identifiers.
• If a firm connects Xero: an access/refresh token (encrypted) with read-only scopes; COHESORA reads the organisation and contact/invoice data you authorise.

3. What COHESORA does not do

• No document content is sent to any AI or language-model service; OCR and extraction run on INVICTT AI's own server. AI assistance is off by default: only if a firm administrator connects the firm's own AI provider account and accepts the data handling does COHESORA send that provider a short fact summary of the record a user asks about (client name, titles, statuses, dates, counts — never document contents, messages, e-mail addresses or phone numbers).
• No advertising or analytics cookies or trackers in the COHESORA application. Only strictly necessary session and CSRF cookies are set.
• No sale of personal data.

4. Why data is processed

To provide the service the firm asked for, to secure it, to send operational emails (verification, password reset, invitations, trial notices), and to meet legal obligations. The exact lawful bases are a legal decision (see below).

5. Where data goes

See Subprocessors. In summary: database in the EU (Paris), documents on a server operated by INVICTT AI, web delivery and proxying by Netlify and Cloudflare, transactional email by Resend, and Xero only when a firm connects it.

6. Retention and deletion

See the Data retention and deletion policy.

7. Your rights

Individuals can ask their accounting firm (the controller) about their data. Requests relating to account data held by INVICTT AI can be made through invictt.com/contact. The process and response times require approval.