Descodify is invitation-only and opens to new users in January 2027. Read your IRS declaration free, no sign-up needed →
descodify

Security

Last updated: October 31, 2026

Descodify handles sensitive financial data - invoices, tax numbers, expense records, and tax authority credentials. We take the responsibility seriously. This page explains what we do to protect your data.

Where your data is kept

Your data is stored in the European Union, with companies under EU law wherever a credible EU option exists. Our GDPR page explains why that matters and lists every sub-processor.

Encryption

  • Every connection to Descodify is encrypted.
  • Stored credentials, such as your tax portal and Social Security portal logins, are encrypted, used only to do what you ask, and never written to logs.

Signing in

  • Descodify has no passwords to steal. You sign in with your email, a passkey, or Google.
  • Your passkey stays on your device.
  • Your session is protected against theft and cross-site attacks.

Access control

  • Only members of a business can reach its data, and only the people you invite become members.
  • An app you connect works with one business only, within the permissions you grant, and never with more access than you have. You can disconnect it at any time in Settings, and it loses access straight away.
  • If you work with a certified accountant or a bookkeeper, invite them through Descodify instead of sharing credentials. Each person signs in with their own login.

No credential sharing

A common practice in Portugal is to give your certified accountant (contabilista certificado) your Portal das Finanças login and keep two-factor authentication disabled so they can access your Portal das Finanças account. Descodify replaces this with proper access management:

  • Each person has their own Descodify user account
  • Certified accountants and bookkeepers are invited to the business with appropriate permissions
  • You keep control of your tax portal credentials and can enable two-factor authentication

Government portals

Connecting your tax portal (Portal das Finanças) or your Social Security portal (Segurança Social Direta) is optional. If you do:

  • Your main tax portal login is never stored. Descodify uses a separate login made only for it (a subuser), which you can also revoke on the tax portal.
  • Every action we take on a government portal for you is recorded.
  • You can disconnect at any time, and the stored login is deleted at once.

AI assistant

  • The AI assistant is optional. It stays off until an owner or partner of the business switches it on, and they can switch it off again in Settings.
  • Only the messages you type are sent to our AI provider. We do not add your invoices, customers or other records to them.
  • Our AI provider does not use your messages to train models.

What we do not do

  • We do not use tracking pixels. We run our own privacy-friendly analytics, with no cookies, and it sends nothing to any third party.
  • We do not set marketing or advertising cookies
  • We do not sell or share your data with third parties, apart from the apps you connect yourself
  • We do not use device fingerprinting
  • We do not store your data in regions outside the EU. The one exception is a feature you opt into: the delivery of notifications through your browser or device push service.

Dependency management

We regularly review and update third-party dependencies to patch known vulnerabilities. Security updates are prioritized and applied promptly.

Responsible disclosure

If you discover a security vulnerability in Descodify, please report it to us privately. We take all reports seriously and will work to address confirmed vulnerabilities promptly.

  • Email: security@descodify.pt
  • Please include a description of the vulnerability, steps to reproduce, and your contact information
  • We ask that you do not publicly disclose the vulnerability until we've had a reasonable opportunity to address it
  • We will not take legal action against security researchers who act in good faith and follow responsible disclosure practices

Questions

For security questions or concerns, email us at security@descodify.pt. For privacy-related questions, see our Privacy Policy.