Data residency
Your books stay in Ethiopia.
Directive 1142/2018 E.C. makes data residency a legal condition of running a sales registration system. This page says exactly where your data lives, what ever leaves, and how you take it with you.
Where your data lives
The regulated stack — the API, the Postgres database, the queues and their backups — runs in a Tier III datacenter inside Ethiopia. Invoices, ledger entries, customers, inventory, credentials, the audit trail and the wire log are all stored there.
What leaves the country
Only what the law requires: the registration payload for each fiscal document goes to the Ministry of Revenues’ EIMS, and its reply — IRN, RRN and QR — comes back. No copy of your business data is sent to a service abroad. The one narrow exception is the breached-password check at sign-up, which sends a five-character hash prefix, never a password or anything about your business.
Backups
Backups are taken from the in-country database and encrypted with a key separate from the one that protects the credential vault. A stolen backup is unreadable ciphertext. Restore is rehearsed into a scratch database, because an untested backup is a rumour.
Export and portability
Article 5·3 of the Directive gives you the right to leave. Owners and admins can export the full tenant bundle — one versioned, re-importable JSON file or per-table CSV — at any time from Settings → Data & privacy. The bundle never contains secrets.
Deletion
An owner can request deletion with a typed confirmation. Personal data is scrubbed in place, credentials and integrator keys are purged, and the tenant is deactivated. Fiscal records — invoices, ledger and audit trail — are retained in anonymised form for as long as tax law requires, and no longer.