DBX ONE

Confidentiality and data handling

Clear answers before you send invoice data.

This page explains what DBX ONE processes, why it is processed, how long it is kept, how AI is used, and what security and sub-processor controls apply.

01

Purpose-limited

Submitted invoice data is used to produce the requested DBX ONE invoice report and communicate about that report.

02

No shared AI training

Customer invoice data is not used to train shared or general AI models and is not reused for other clients.

03

One-month starting point

The free report is designed around last month’s supplier invoices, not historical bulk uploads.

Processor contract

Data Processing Agreement coverage.

Where DBX ONE processes personal data in invoice files for an organisation, DBX ONE acts on the organisation’s documented instructions and can provide a Data Processing Agreement before processing starts.

What is processedSupplier invoices, invoice metadata, supplier names, invoice numbers, dates, line items, quantities, net/VAT/gross amounts, delivery charges and notes provided with the submission.
Why it is processedTo produce the requested invoice report, identify review points and communicate about the report.
Written instructionsDBX ONE processes submitted invoice data only for the requested report and any agreed follow-up work.
ConfidentialityAccess is limited to people who need the data to produce or support the report and who are bound by confidentiality obligations.
Deletion or returnInvoice files can be deleted or returned on request, subject to legal or operational retention requirements set out in the DPA.
Breach notificationIf DBX ONE becomes aware of a personal-data breach affecting submitted invoice data, the organisation will be notified without undue delay.
Read the DPA terms

AI use

Your invoice data is not used to train shared models.

DBX ONE may use AI to help extract, structure and review invoice information. Customer invoice data is not used to train DBX ONE models, shared AI models or general AI models, and is not reused for other clients.

AI processing rule: Invoice data is used for the requested report only. AI output is treated as a review aid and is checked before report delivery.

Security

Security controls and evidence.

DBX ONE’s security approach is based on restricting access, encrypting data in transit and at rest, and keeping invoice files in controlled cloud storage rather than scattered across unmanaged devices.

Hosting and storageWebsite hosting and uploaded-file storage are operated through Cloudflare services, including Cloudflare Pages/Functions and R2 object storage.
EncryptionWebsite traffic uses HTTPS. Uploaded objects are stored in cloud object storage with encryption controls provided by the storage platform.
Access controlsAdministrative access should use MFA, least-privilege access and named accounts only.
Audit and reviewSubmission records, storage activity and access events should be reviewed where platform logs are available.
BackupsReport outputs and working files are retained only for the agreed period and should not be copied into unmanaged personal storage.
Incident responseSuspected security incidents are assessed, contained, recorded and communicated to affected organisations where required.

Cyber Essentials or Cyber Essentials Plus certification is not claimed unless separately confirmed in writing.

Sub-processors

Who may handle the data.

DBX ONE will maintain a sub-processor list for organisations that require a DPA. Sub-processors are used only where needed to host the website, store submitted files, operate email or support AI-assisted invoice processing.

Sub-processorPurposeNotes
CloudflareWebsite hosting, Cloudflare Pages/Functions, uploaded-file storage in R2.Used for site delivery and storage infrastructure.
OpenAI API / business AI serviceAI-assisted extraction, structuring and review of invoice data where used.Used only for the requested report; no shared/general model training.
Email provider for info@dbxone.co.ukOnly applies if invoices are forwarded by email.Provider details can be confirmed in the DPA/sub-processor list before processing.

DBX ONE will not add a new sub-processor for client invoice data without the authorisation process set out in the DPA.

Data minimisation

Send only what is needed for the report.

The report usually needs supplier, date, category, item description, quantity, net/VAT/gross cost and delivery charges. If possible, remove anything that is not needed for invoice review.

Useful to include

  • Supplier name and invoice date
  • Line items, quantities and prices
  • Delivery charges and VAT totals
  • Categories or notes you want reviewed

Remove where possible

  • Bank details and account numbers
  • Staff names if not needed
  • Delivery notes or handwritten notes that are not relevant
  • Anything unrelated to supplier invoice review

Retention

How long files are kept.

For free reports, invoice files are intended to be retained only for the time needed to prepare, quality-check and deliver the report. A standard retention period can be agreed in the DPA; for most free-report submissions, DBX ONE’s default target is deletion within 30 days after report delivery unless an ongoing service is agreed.

During report preparationFiles are stored while the report is produced and checked.
After deliveryFiles can be deleted or retained briefly for queries, according to the agreed retention period.
Ongoing serviceRetention is agreed separately if monthly or wider reviews are arranged.

For practices and clinics

Internal sign-off before sending files.

If your organisation has a DPO, IG lead, Caldicott Guardian equivalent, finance lead or procurement owner, run the submission past them before sending invoice data. If the invoice files contain personal data, your organisation may also need to record the processing in its ROPA.

Apply free today

Operator and accountability

DBX ONE is operated by Dillon.

Reports are handled through DBX ONE by Dillon, the founder of the service and a UK medical student with experience in GP practice settings. Practices can request a signed DPA and additional supplier information before sending invoice files.

Service contactinfo@dbxone.co.uk
Data/privacy contactinfo@dbxone.co.uk
Report handlingInvoice submissions are used to prepare the requested DBX ONE report and are not reused for other clients.