Generative AI & what it does in Zenvoices
Zenvoices uses AI services from Microsoft Azure for:
recognising Custom fields on an invoice;
creating a summary of the description on an invoice;
classifying the document type or cost category, for example fuel costs.
Based on the invoice, the AI generates a suggestion for the booking line. This suggestion is always presented to you first for review. The AI does not make decisions itself, you review and confirm every suggestion before it is processed. The AI's output is not stored independently or used for any other purpose.
Generative AI & your data & GDPR
Processing within the EU
The AI services we use are part of the Microsoft Azure platform. Microsoft is included in our GDPR structure as a sub-processor, under a valid data processing agreement. Processing takes place exclusively within the European Economic Area, via Microsoft's data centres in Europe. Your data does not leave the EU.
Your data is not used for AI training
Your invoice data is not used to train or improve AI models. Microsoft has contractually confirmed this in its data processing agreement. Your data is only used for the purpose for which you use Zenvoices: processing your invoices.
Personal data on invoices
Invoices can sometimes contain personal data, for example an employee's name or a business address. This is regular personal data, not a special category under GDPR. The legal basis for processing is legitimate interest or performance of the contract.
Please note: does your administration involve special categories of personal data? The generative AI functionality can be switched off, per environment, per administration, or per user. This way, you always stay in control of where generative AI is and isn't used.
Generative AI & technical security
The integration of generative AI has been set up according to common security standards:
Encrypted communication: all communication with the AI services runs via secure, encrypted connections (HTTPS). Access keys are never visible to end users.
Access management: access to systems and data is strictly limited based on the need-to-know principle.
Data minimisation: only the data needed for the specific recognition task is sent to the AI service.
No unnecessary storage: data processed by the AI is not retained longer than operationally necessary and is not shared outside the processing chain.
Audit logging: all AI calls are logged for monitoring and incident response.
Certifications: Microsoft Azure holds ISO 27001, SOC 2 Type II, and other international security certifications. Zenvoices itself is also ISO 27001 certified.
You stay in control
With our generative AI application, you as a user always stay in control:
All AI suggestions are presented to you for review.
You always confirm or correct a suggestion yourself before it is saved.
Manual intervention is always possible, you are never dependent on the AI's output.
All output and any corrections are logged for traceability.
Generative AI & EU AI Act
Zenvoices' AI application does not fall under the 'Unacceptable risk' or 'High risk' categories of the EU AI Act. It concerns automated document processing in a business context, without significant decisions about individuals. We closely follow developments around the EU AI Act and adjust our processes and documentation accordingly.
Summary
The AI functionality in Zenvoices is GDPR-compliant, technically secured, and classified as low risk under the EU AI Act. Your data is processed within the EU, not used for AI training, and only used for the purpose for which you use Zenvoices. You always stay in control, the AI supports you, but does not decide.
Do you have questions? Feel free to contact us at support@zenvoices.com.