Magic Heidi Your bookkeeping, safe in Zurich
Security and data protection without the small print: invoices, receipts and client data are stored encrypted in Zurich, under Swiss law. And we tell you openly what runs abroad.
Three questions to ask any app.
Your bookkeeping holds client addresses, IBANs, revenue and bank transactions. Before you type them in anywhere, these three questions deserve a clear answer.
Where is my data?
In Switzerland, the EU or the USA? And which law applies there?Who can see it?
Staff, partners, ad networks, AI providers?Can I leave again?
Export, cancellation and deletion, without hurdles?Where your data really lives
Everything that makes up your bookkeeping is stored in Zurich. A few supporting services run abroad, and we tell you which ones. Here is the overview.
| What | Provider | Where |
|---|---|---|
| Invoices, quotes, clients, expenses | Google Cloud | Zurich 🇨🇭 |
| Receipts and attachments | Google Cloud | Zurich 🇨🇭 |
| Bank connection (read-only) | SIX bLink | Switzerland 🇨🇭 |
| AI receipt scanning | Anthropic | USA |
| Email delivery | Postmark | USA |
| Subscription and payment | RevenueCat, Stripe | USA |
| Usage analytics, error diagnostics | Mixpanel, Vercel, Sentry | USA |
| Integrations (optional) | e.g. Zapier, Shopify | depends on provider |
Your data is stored on Google Cloud (Firebase) in Zurich. RevenueCat manages your subscription, Stripe handles web payments, and in-app purchases go through Apple or Google. Usage analytics are anonymised, and Sentry collects technical error and diagnostic data. Integrations only process data if you switch them on. Parts of Google's infrastructure and delivery networks may also process data in the EU, closer to you.
Every transfer abroad is covered by standard contractual clauses or another legally permitted basis, and every partner is contractually bound to protect your data. The full details are in our privacy policy.
Who sees your data: almost no one
Encrypted in transit and at rest, access only when it is needed, and read-only for your bank.
Encrypted
Every connection runs over TLS, and stored data is encrypted with AES-256.
- Every connection encrypted
- TLS 1.2 or newer
- AES-256 for stored data
- Weekly encrypted backups
Protected access
You secure your account with 2FA (two-factor login). On our team, only people who really need access have it.
- Two-factor authentication available
- Team access only when needed, with MFA
- Your data is never sold, to anyone
- Receipts only leave for the scan
Bank read-only
The bank connection runs through SIX bLink, the Swiss open banking platform.
- Heidi reads transactions, never pays
- Your e-banking login stays with your bank
- Only with your explicit consent
- Revocable at any time
Your data belongs to you
No lock-in: export, cancel or delete whenever you want. Since you have to keep your business records for 10 years (Art. 958f CO), export everything before you delete.
Export anytime
Everything as a ZIP with original receipts, plus PDF and CSV for your accountant.
Cancel in the app
No contract lock-in, no phone call. Access until the end of the period.
Delete your account
Deleted within 30 days, backups after 90 days at most. Legal obligations reserved.
Access by invite only
Your accountant or a second person only sees it if you invite them.
Data protection under the nFADP.
And GDPR.
Magic Heidi is run by Magic Heidi AG in Vaux (VD): on the market since 2023, self-funded and profitable. We apply the new Swiss data protection act (nFADP): only the data we need, privacy-friendly defaults.
Privacy by design & default
For your clients in the EU
To the FDPIC, within 72 h if required
UID CHE-215.620.945
Trust you can check
4.8 out of 5 from more than 200 public reviews. Each one links to its source.
“Accounting software made by a small business for small business owners … The owner also offers very good support and is there for every question.”
“In just seconds, I was able to solve invoicing tasks that would have taken me hours with other solutions … If you are a freelancer in Switzerland and want to send invoices easily, quickly, and securely, this tool is for you.”
“Very easy to use and particularly efficient, Magic Heidi is a reliable, high-performing solution for professional use.”
Questions about security and privacy
Where is my data stored?
Your invoices, quotes, clients, expenses and uploaded receipts are stored on Google Cloud servers in Zurich and fall under Swiss data protection law. A few supporting services run in the USA: AI receipt scanning, email delivery, subscription payments, anonymised usage analytics and error diagnostics. The complete list is in our privacy policy.
Is Magic Heidi nFADP and GDPR compliant?
Yes. We apply the new Swiss Federal Act on Data Protection (nFADP, also called revFADP, in force since September 2023) and meet the requirements of the GDPR, so you can also use Magic Heidi for clients in the EU. We only collect the data your bookkeeping needs and use privacy-friendly default settings.
Are my receipts sent abroad for AI scanning?
Yes, and we say so openly. When you scan a receipt, the file goes to Anthropic in the USA. Their AI reads the amount, date, VAT and merchant. This only happens for that feature, and we don't train any AI on your receipts. More on AI receipt scanning.
Can the Magic Heidi team see my invoices?
Only in exceptional cases. Access is limited to people who need it to run the service or answer your support request, and only with multi-factor authentication. We don't analyse your invoices and we never sell your data, to anyone.
How secure is the connection to my bank?
The bank connection runs through SIX bLink, the Swiss open banking platform, and is read-only: Magic Heidi sees your balance and transactions but cannot make payments. You log in directly with your bank, and we never see your e-banking credentials. You can revoke the connection at any time in the app or with your bank. More on bank reconciliation.
What encryption does Magic Heidi use?
All connections between your devices and our servers are encrypted with TLS (version 1.2 or newer), and stored data with AES-256, the standard banks use too. The weekly backups are encrypted as well. You can also protect your account with two-factor authentication.
What happens in the event of a data breach?
We report it to the Federal Data Protection and Information Commissioner (FDPIC) as quickly as possible, within 72 hours where required. If there is a high risk to you, we contact you directly and explain what happened and what we are doing about it.
Can I export my data and delete my account?
Yes. You can export everything at any time: a ZIP with all original receipts, invoices and reports as PDF, transactions and contacts as CSV. If you delete your account, we remove your data within 30 days unless the law requires us to keep it longer, and encrypted backups are gone after 90 days at most. Since you must keep business records for 10 years, export everything first. Here's how: delete your data.
What happens to my data if Magic Heidi shuts down?
Magic Heidi has been around since 2023, self-funded and profitable, with no investors breathing down our neck. And you're never locked in: you can export your invoices, receipts and contacts as PDF, CSV or ZIP at any time and take them with you, wherever you switch to.
Can I try Magic Heidi for free?
Yes. You start with 3 invoices and 3 receipts in total, free, with every feature and no credit card. After that, Pro costs CHF 24.99/month on the yearly plan (CHF 299/year) or CHF 39 billed monthly, VAT included, with a 30-day money-back guarantee. All the details are on the pricing page.
Start with peace of mind
Data in Zurich, encrypted and protected by Swiss law. Start for free, no credit card. Security questions are often answered by Nathan himself.
