Secure in the cloud.
Hosted in Germany.
Designed for GoBD requirements
Immutable entries, complete document numbering, full audit trail
Privacy processes
Privacy processes, data processing agreement and technical safeguards prepared
Servers in Germany
Own servers at Intercolo in Düsseldorf. No AWS, no Google, no Azure
2FA & Roles
Two-factor authentication, granular roles, tax advisor access
Infrastructure
Cloud without compromises.
Why we rely on our own servers instead of AWS, Google, or Azure.
Own Hardware, Full Control
Pavavo runs on Intercolo servers in Düsseldorf – own hardware in a German data center. No hyperscaler, no detour through US companies. Regular processing takes place in Germany.
Cloud Comfort, European Values
You use Pavavo like any modern cloud app – open browser, log in, get started. No server setup, no updates to install. We handle everything so you can focus on your business.
GoBD
Traceable from day 1.
The principles for proper bookkeeping and retention of books are reflected in the core workflows.
Immutability
- No UPDATE or DELETE on posted entries – technically prevented
- Corrections only via reversal entries
- Complete, sequential document numbering per fiscal year
Logging & Archiving
- Complete audit trail: who, what, when, before/after
- Audit-proof document archive (10-year retention requirement)
- Procedure documentation generatable and maintainable
GDPR
- Processes for data subject requests prepared
- Deletion pursuant to Art. 17 (Right to be forgotten)
- Processing register integrated
Access Control
- 2FA via TOTP / Authenticator app
- Roles: Admin, Accountant, Purchasing, View-only, Tax Advisor
- Automated daily backups with data recovery
Technical Details
Under the hood.
For IT managers and data protection officers. Current system status at status.pavavo.com.
Hosting & Location
- Own servers at Intercolo, Düsseldorf
- No AWS, Google Cloud, or Azure
- No data transfers to third countries
- German data center with professional security standards
Encryption
- TLS 1.3 for all connections
- Passwords: bcrypt-hashed (cost 12)
- API tokens: SHA-256-hashed
- Webhooks: HMAC-SHA256-signed
Backups & Recovery
- Automated daily backups
- 30-day backup retention
- Point-in-time recovery available
- Geo-redundant backup storage
Availability
- High availability target over the annual average
- Planned maintenance with 48h notice
- Automatic scaling during peak loads
- Real-time monitoring of all systems
- Status dashboard at status.pavavo.com
Data Isolation
- Strict separation of all company data
- No cross-account data access possible
- Isolation enforced at database level
- Regular security audits
Monitoring & Logging
- Complete audit trail of all booking actions
- Login logging (IP, timestamp)
- Rate limiting on API and auth endpoints
- CSRF protection on all forms
Ready for free
accounting?
Start with invoices, receipts, e-invoicing, bank connectivity, Stripe, PayPal, payment matching and VAT preview in the Free plan. Upgrade only for recurring invoices, dunning, tax submission, DATEV export, AI and automation.