Billit Trust Center

Billit is certified as compliant with ISO/IEC ISO27001:2022, the premier global information security management system (ISMS) standard. 

Billit uses a zero-trust security model. This means that no user or connection is trusted by default. Access is revalidated with every action through strong identity verification, up-to-date devices, restricted permissions, and continuous monitoring. This approach ensures that data is only accessible to authorized and validated entities.

Yes. Billit undergoes yearly internal and external audits to verify compliance, security controls and operational integrity. Billit does not share these audit reports.

Yes. Independent security firms perform penetration tests on Billit’s platform and infrastructure at least once a year. Findings are reviewed, risk-rated and remediated following the Billit security governance process. Billit does not share these audit reports.

Yes. You may perform your own tests on our dedicated test environment, provided you obtain our explicit written consent before starting any activity. Any activity on the test or production environment without consent will be treated as hostile and appropriate actions will be taken.

Billit provides multiple layers of protection for the information you entrust to Billit, including encryption when it's transferred and stored. 

Multi-factor authentication (MFA) is designed to prevent anyone but you from accessing your Billit account, even if they know your password. Billit is implementing MFA as the standard method of authentication. 

Security controls protect access to and within the Billit environment, including firewalls, intrusion protection systems and network segregation. 

Billit uses TransIP & Amazon Web Services (AWS) as its primary hosting provider. Our production environment is hosted in highly secure TransIP & AWS data centers located within the European Union (Netherlands and Ireland). For specific supporting services, limited processing may occur in other AWS regions, always under strict GDPR-compliant safeguards. 

Billit has no plans to store customer data outside the EU. GDPR does not require EU data to remain inside the EU, but it does require appropriate safeguards for any international transfer. When limited processing outside the EU is necessary, Billit applies the legally required protections.

A full and up-to-date list of Billit’s sub processors is available on our website. Each sub processor is contractually bound by GDPR-compliant safeguards and security obligations.

Billit NV sub processors

Billit Inc. sub processors

If personal data is processed outside the European Economic Area, Billit ensures it remains protected by EU-level safeguards. We rely on officially approved mechanisms such as the European Commission’s Standard Contractual Clauses (SCCs). All sub processors are assessed, onboarded and monitored under strict GDPR, ISO 27001 and DORA policies. 

Yes. The Billit Data Processing Addendum (DPA) automatically applies as part of the Terms of Use for any customer subject to GDPR. No separate agreement is required.

1. Encrypted cloud storage
   Billit secures business data with multiple layers of protection and encrypted cloud storage. User information stays safe, private and accessible whenever users need it. 
   
2. Stronger login security
   Billit uses multi-factor authentication to verify its users’ identity. Alongside their email and password, users confirm access with an authentication app on their phone or tablet. This helps prevent anyone else from entering a user’s account, even if they know the password. 
   
3. Company level user access
   User access is regulated on company level.  No one can view company data unless they are granted access. Companies can choose what each user can see or do inside Billit. 
   
4. Personal information stays private
   Billit only uses user data for the purposes users approve. If users request support, they can choose to grant the Billit team temporary access to help resolve an issue. 
   
5. Secure cloud storage
   User data is safely stored and backed up in the cloud. If a user’s device is lost, stolen or damaged, nothing is lost. Users can simply log in from another device and continue working. 
   
6. Industry-standard encryption
   User information is encrypted using strong, industry-standard methods that prevent unauthorized access. Billit stores user data securely and users remain in full control of who can view it. The Billit infrastructure has strict physical security and is monitored around the clock. 
   
7. High availability
   Company data is replicated across multiple locations to ensure it’s always accessible. Billit is available 99.9% of the time with minimal interruption to businesses. 

Billit can only be accessed through modern, fully up-to-date systems & browsers. This requirement ensures security, data protection and full platform functionality for all international customers. If a browser is outdated or unsupported, access may be blocked to safeguard your data and maintain compliance standards. 

We do not disclose details about our technical architecture. This policy protects the security and integrity of our platform and aligns with our obligations under ISO 27001, DORA and national supervisory requirements. We only share high-level security assurances and certificates when contractually required. If you need specific evidence for a risk assessment, we can provide it through controlled channels under NDA. 

Yes. All staff must accept the acceptable use policy,  the confidentiality terms and data breach escalation procedure before they can access Billit systems or data. This is enforced during onboarding and validated through our compliance controls. 

Billit stores and retains data in line with legal, regulatory and contractual requirements. Data is hosted in secure, certified environments with encryption active at all times. Retention periods are strictly defined, and data is deleted or anonymised once the relevant period expires. Access is limited to authorised roles only, and all processing follows ISO 27001 and DORA standards. If specific retention terms are needed, we can provide them under NDA. 

Billit enforces an inactivity timeout of 15 minutes and a full session timeout of 24 hours to reduce unauthorized access risks.