# Data processing

What we process and for which purposes.

This page explains the main data flows in Cortena at a high level.

## 1. Purpose

To describe what data Cortena processes and how it moves through the system.

## 2. Scope

Applies to all platform workflows including document intake, matching, classification, export, banking connectivity, reconciliation, and any other finance automation workflows enabled by the customer.

## 3. Core workflows

### 3.1 Document and data intake

Financial documents and related files (for example invoices, receipts, statements) may be ingested via user uploads and/or inbound email (if configured). From 10 September 2026, inbound email is received via Cortena self-hosted ReceiveHQ ([receivehq.com](https://receivehq.com)). See [Sub-processors](https://help.cortena.ai/compliance/sub-processors).

### 3.2 Data storage

Core application data is stored and processed in Germany on Cortena's hosting infrastructure. See [EU hosting](https://help.cortena.ai/compliance/eu-hosting).

### 3.3 Workflow automation

Cortena processes document content and financial data to apply business rules (accounts, VAT logic, cost centres, reconciliation matching, cash flow operations), based on customer-provided guidelines and structures.

### 3.4 AI processing

Cortena may use third-party LLM providers for extraction, matching, analysis, and assistance. Cortena aims to minimize data shared and secure transmission (TLS/HTTPS). See [Sub-processors](https://help.cortena.ai/compliance/sub-processors) for the full provider list.

### 3.5 Accounting exports

Cortena supports exports to accounting systems (for example DATEV, Exact Online). For DATEV, Cortena uses the official API (Rechnungsdatenservice 1.0).

### 3.6 Banking connectivity (if enabled)

Banking connectivity and payment initiation are provided via optional PSD2 providers (**Yapily** and/or **finAPI GmbH**), only when the customer enables them in Cortena. See [Sub-processors](https://help.cortena.ai/compliance/sub-processors).

## 4. International transfers

Core application data is processed in Germany. Some sub-processors may process limited data outside the EU/EEA, with safeguards where required.

## 5. Contact

[compliance@cortena.ai](mailto:compliance@cortena.ai) · [dpo@cortena.ai](mailto:dpo@cortena.ai)