Your clients' data, protected and provable
Encryption in transit and at rest, two-step verification by email, field-level audit trails and retention built for Andorran, Spanish and French law.
Your data, kept safe
Financial data is encrypted in transit and at rest, with a full audit trail.
Encryption in transit and at rest
Documents are encrypted at rest (AES-256) and in transit (TLS).
Two-step verification
Optional two-step verification with a one-time code sent by email, for an extra layer of account security.
Automatic Backups
Continuous database backups with point-in-time recovery, managed by our database provider (Neon).
Complete Audit Trail
Every action logged with user, timestamp and IP address for full compliance.
Built to the frameworks you answer to
The regulations and standards baked into every workflow.
GDPR
EU data protection by design: encryption, data minimization and the right to erasure, honoured within the legal retention window.
UIFAND
Andorra's financial-intelligence obligations: AML/KYC checks, beneficial-owner assessments and 10-year record retention.
AML / KYC
Sanctions and PEP screening, risk scoring and ongoing monitoring, with a documented decision trail for every client.
Two-step verification
A one-time code sent by email protects the sign-in of anyone who turns it on.
Hosting and encryption
Data is hosted on Vercel and Neon infrastructure, encrypted in transit and at rest.
Tenant isolation
Every firm and business is scoped to its own tenant — one account's data is never reachable from another.
Security questions, answered
On Vercel and Neon (Postgres) infrastructure, currently in United States data centres, encrypted in transit (TLS) and at rest. Tenants are isolated, so one firm’s data is never reachable by another.
Role-based access with optional two-step verification by email, per-firm tenant scoping and a documented permission model. Client-role users can never reach firm-side data, and within a firm, restricted access limits which staff see which clients.
Yes — every create, change and deletion is timestamped with the user and IP, with per-field before/after history. Locked accounting periods and retained documents cannot be silently altered.
What is deleted is kept before it is purged: invoices for 7 years, payslips and KYC/AML data for 10, and documents linked to invoices, payslips or KYC files for their legal period. A generic document in the trash can be restored for 30 days. The general audit log is kept for 5 years; the compliance and security log for 10.
No. bluri is not ISO 27001 certified. We apply our own security controls (role-based access, tenant isolation, an audit trail and encryption), but they are not certified by a third party.
The database has continuous backups with point-in-time recovery, managed by our provider (Neon) and encrypted at rest.
Ready to spend less time on paperwork?
Freelancers, businesses and firms across Andorra, Spain and France — start free for 30 days, no card required.
No card required · Cancel anytime · 30-day free trial