Security
How we protect your data
Your invoices, your certificate and your password are handled with care. Here is exactly what we do.
Nobody else gets into your account
- Your password is never stored. We keep only an Argon2 hash of it, which can't be turned back into the password.
- We confirm your email address before you can add a company.
- A password reset link is sent only when you ask for it, and it works for one hour.
- Sessions are short and renew themselves only while you work.
Your signing certificate stays yours
- A certificate file you upload, and its password, are stored encrypted.
- With a USB token, the private key never leaves the token. The app only asks it to sign.
- Token signing uses our own browser extension, “Brza Faktura – UJP Signer”. It is made by Synadra, not by UJP.
- You can replace the certificate at any time in the company settings.
Documents reach UJP unchanged
- Every request to UJP is signed with your company's certificate.
- All communication — with you and with UJP — goes over an encrypted HTTPS connection.
- You see the status UJP returns for every document, and the history of its changes.
Only the right people can send
- Every person in a company has a role. Only the owner, admins and accountants can sign and send to UJP.
- People join by invitation only, and an invitation expires if it isn't used.
- You can change a role or remove a person at any time.
What we don't do
- We don't sell your data or use it for advertising.
- We don't use your invoices for anything other than showing them to you and sending them to UJP.
- We don't act as UJP. Brza Faktura is an independent product that connects to UJP's system in your name.
Found a weakness?
Tell us first. Describe what you found and how to repeat it, and we will answer you.
Write to usSend your first e‑invoice today
Create an account, add your company and connect to UJP. It's free.