Security
Two signatures above €50k. And a record of both.
Every payment run is prepared by one person and approved by another, with thresholds you set. Headroom keeps the chain, the times and the devices, and your bank still holds the release.
SOC 2 Type II
ISO 27001
EU data protection
Read-only by default
(01) Four eyes
Prepare, approve, release. Never the same person twice.
Switch the role to see what each person can do with the same payment run.
View as
Viewer
Preparer
Approver
Admin
Signs up to €500k. Sees why each payment is here.
Payment run · 17 Oct · SEPA · 12 payments
€1,384,906.40
Kessler Stahl GmbH
DE
€512,880.00
Waiting · CFO
Rheinkai Logistik
DE
€96,240.50
2 signatures
Atelier Morvan
FR
€18,412.00
1 signature
Nordlys Packaging AS
NO
€61,905.30
2 signatures
Ferrovia Sud Srl
IT
€148,300.00
2 signatures
Halse & Grieve Ltd
UK
€37,618.20
1 signature
Coteaux Énergie
FR
€204,115.75
2 signatures
Brandt Industrietechnik
DE
€9,862.40
1 signature
Lusitânia Têxteis
PT
€52,770.00
2 signatures
Vireo Software BV
NL
€24,000.00
1 signature
Marmot Facilities
UK
€14,236.90
1 signature
Oskar Pålsson AB
SE
€204,565.35
2 signatures
11 released · 1 waiting · €872,026.40 sent
≤ €50k · 1 signature
> €50k · 2 signatures
> €500k · + CFO
LR
Lucía Romero
Preparer · AP lead
12 prepared
TB
Tom Becker
Approver · Financial controller
7 approved
SV
Sanna Virtanen
Treasurer · Group treasurer
11 released
Released to Commerzbank · 11 payments · Kessler Stahl waits for the CFO
(02) Roles
Four roles, ten actions, no grey areas.
Roles are granted by entity, so a regional controller can approve in Poland and only view in Germany.
Action
Viewer
Preparer
Approver
Admin
View balances and forecasts
✓
✓
✓
✓
Export to Excel and PDF
✓
✓
✓
✓
Build a payment run
—
✓
—
✓
Approve up to €500,000
—
—
✓
✓
Approve above €500,000
—
—
✓
✓
Release to the bank
—
—
✓
—
Edit thresholds
—
—
—
✓
Add a bank connection
—
—
—
✓
Invite users
—
—
—
✓
Change roles
—
—
—
✓
(03) Thresholds
Nobody approves a run they prepared.
Three rules cover most groups. Change the amounts, add a signer, or require the CFO above a line you choose.
Up to €50,000
1
signature
Any Approver of the entity.
Above €50,000
2
signatures
Two Approvers, neither of them the Preparer.
Above €500,000
2 + CFO
signatures
Two Approvers, then the CFO signs last.
(04) The record
One payment, every signature on file.
Each payment keeps who prepared it, who approved it, when, from where and on which device. Export it for your auditors in one click.
PAY-2026-10-0418 · Orvane GmbH · Commerzbank · EUR
Kessler Stahl GmbH
€182,400.00
Released · 17 Oct 09:12 CET
1
Prepared
Léa Moreau · Preparer
16 Oct 2026 · 14:02:11 CET
192.0.2.41 · MacBook Pro · Berlin
2
Approved
Jonas Weber · Approver
16 Oct 2026 · 16:47:30 CET
198.51.100.7 · iPhone 15 · Munich
3
Approved
Sofia Kowalska · Approver
17 Oct 2026 · 08:55:04 CET
203.0.113.19 · ThinkPad X1 · Warsaw
(05) Data
Where your data lives, and who can read it.
D-01
Frankfurt by default, London on request. Backups stay in the same region.
D-02
TLS 1.3 in transit, AES-256 at rest, keys rotated every 90 days.
D-03
Read-only until you switch payments on, entity by entity.
D-04
Answers come from your workspace only. Your data never trains a shared model.
(06) Certifications
Audited every year, shared under NDA.
The security pack holds the control report, the latest penetration-test summary and our data-processing agreement.
Demo content. Certifications, dates and report periods on this page are placeholders: replace them with your own, or remove this section.
✓
SOC 2
Type II
Report for the period Apr 2025 – Mar 2026
✓
ISO 27001
2022
Certificate valid until Sep 2028
✓
GDPR
EU · UK
Data-processing agreement in every contract
✓
Pen test
2026
External test, summary in the pack
(07) Questions
What your auditors will ask first.
S-01
Can Headroom release a payment on its own?
+
No. Headroom prepares the run and collects the signatures. The release happens in your bank, with your bank’s own authentication.
S-02
Who can change the approval thresholds?
+
Only Admins, and a change to a threshold is itself a four-eyes action: a second Admin has to confirm it before it applies.
S-03
Where is the data hosted?
+
In Frankfurt by default, in London on request. Backups stay in the same region and are encrypted with keys we rotate every 90 days.
S-04
Does the AI train on our data?
+
No. The bridge answers from your workspace only and cites the ledger lines it used. Your data never trains a shared model.
S-05
Can we use our own identity provider?
+
Yes, on the Group plan: SAML single sign-on and SCIM provisioning, so leavers lose access the moment they leave your directory.
S-06
How do we get the security pack?
+
Ask for it from this page. It contains the control report, the penetration-test summary and the data-processing agreement, shared under NDA.