Your data, protected
and compliant with Moroccan law.
Encrypted connections, two-factor authentication, strict isolation between companies, automatic backups and readiness for the 2026 DGI reform. Here's how Billora protects your invoices and your data.
Hosting and infrastructure
Billora is hosted by a professional hosting provider, behind a content delivery network (CDN) that absorbs traffic and filters attacks. The application is monitored continuously.
- Professional hosting, restricted and protected server access
- Content delivery network with denial-of-service protection
- Automatic detection of application errors
- Test environment separate from production
Data encryption
All communication between your browser and Billora is encrypted (HTTPS). The most sensitive information is protected at rest: passwords are irreversibly hashed and secrets are encrypted.
- HTTPS required on every page and every API
- Passwords hashed with a modern, salted algorithm (irreversible)
- Session and invitation tokens stored in hashed form
- Connection secrets (SMTP, e-invoicing) encrypted at rest
- Client portal links protected by random, unguessable tokens
Authentication
Several layers of protection against unauthorized access: strong passwords, server-side verified two-factor authentication, attempt limiting and bot protection.
- Password: at least 8 characters, with at least one uppercase letter and one digit
- Two-factor authentication: authenticator app (TOTP), email, and single-use backup codes
- Without the second factor, no data is accessible and 2FA settings cannot be changed
- Temporary account lock after repeated failures, plus per-IP attempt limiting
- Bot protection on sign-in, sign-up and password reset
Isolation between companies
Each company has its own space. Every request is checked so that a company can never read or modify another company's data.
- Systematic ownership check on every document, client, product and file
- Per-user roles (owner, administrator, collaborator, accountant, viewer) verified on every request
- Removing or deactivating a member takes effect in under a minute
- Automated tests verify isolation and access controls with every change
Backups and continuity
Data is backed up automatically by our hosting provider. You can export your data at any time.
- Automatic database backups by the hosting provider
- CSV exports of your clients, suppliers, invoices, quotes, expenses and payments
- Fiscal export (ZIP archive) for your accountant or an audit
GDPR and Law 09-08 (Morocco)
Billora applies the principles of the General Data Protection Regulation (GDPR, applicable to your European customers) and of Moroccan Law 09-08 on the protection of personal data.
- Explicit consent for non-essential cookies
- Right of access, rectification, erasure and portability
- Data used only to provide the service
- Deletion of your data on request
DGI compliance and 2026 e-invoicing
Billora is built for the 2026 e-invoicing reform: UBL 2.1 format, electronic signature and submission to the DGI once activated.
- UBL 2.1 generation compliant with DGI specifications
- Electronic signature with your company's certificate
- Submission to the DGI once e-invoicing is activated
- Integrity fingerprint recorded for every DGI-validated invoice
- Export at any time for your 10-year legal retention (Article 211 CGI)
Incidents and transparency
In the event of a security incident or outage, we communicate with the affected customers. The status page shows in real time whether the service is available.
- Public status page (billora.ma/status)
- Affected customers informed of any incident impacting them
- In the event of a personal data breach, notification to the CNDP within the legal deadlines
Responsible disclosure
We welcome vulnerability reports. Researchers who contact us in good faith are thanked and, with their consent, publicly credited.
- Dedicated contact: support@billora.ma
- Acknowledgement within 48 business hours
- No legal action against good-faith researchers
- Critical vulnerabilities fixed as a priority
Found a vulnerability? Contact us.
Email us at support@billora.ma with a technical description and the steps to reproduce the issue. We acknowledge receipt within 48 business hours and fix any critical vulnerability as a priority.
support@billora.maSecurity frequently asked questions
Where is my data hosted?
With a professional hosting provider, behind a content delivery network that filters attacks. For security reasons we do not publish the details of our infrastructure; the information needed for a security assessment can be provided on request at support@billora.ma.
Is my data encrypted?
Yes. All connections are encrypted (HTTPS). At rest, passwords are irreversibly hashed and connection secrets (SMTP, e-invoicing) are encrypted. For every DGI-validated invoice, an integrity fingerprint is recorded.
What happens if Billora shuts down?
You can export your data at any time (CSV exports and fiscal export). If the service were to shut down, you would be informed in advance so you can retrieve all your data.
Who at Billora can access my data?
Only a restricted team, for explicit support needs (resolving a ticket, a requested migration). These accesses are named, protected and limited to what is strictly necessary.
Is Billora GDPR compliant?
We apply GDPR principles to all our users, even though it legally applies only to your European customers: explicit consent, right of access, rectification, erasure and portability. Moroccan Law 09-08 is also respected.
Can I export my data?
Yes, at any time, from Settings → Export: CSV exports (clients, suppliers, invoices, quotes, expenses, payments) and a fiscal export in ZIP format. The formats are open and reusable in other tools.
What happens to my data after cancellation?
Your data is kept for as long as needed to meet our legal obligations, then deleted. You can request the deletion of your data at any time at support@billora.ma.
Need information for a security assessment?
Our team answers questions from IT departments, CISOs and legal teams and provides the information needed for your assessment.
Last updated: September 18, 2026