This description covers the Financial Controller agent. The wider AI Office of the CFO package also lists Travel, Procurement and Payments agents; confirm the scope you need.
Task classification by ETHORITY; match it to your intended use.
Connects with
“Integrations with 40+ ERP/Accounting/HR systems”; live accounting to Xero, QBO, Exact Online in every module; native bidirectional ERP add-ons NetSuite, Dynamics Business Central, Microsoft Finance, Sage Intacct; native DATEV (DATEV DUO / Unternehmen Online); Slack; 50+ HRIS
“Payhawk AI may struggle in some specific cases” – handwritten or faded receipts, non-Latin characters, multi-currency edge cases, uncommon invoice formats, ambiguous categorisation; agent pauses at CAPTCHA/2FA; agent “cannot change account settings or make purchases”; not available to UK micro-enterprises or small charities
Provider-stated time claim: “Submit expenses 62% faster, and clear approvals in just 3.5 days”
Fit and decision conditions
Prerequisites
Payhawk platform subscription (agent “built into Payhawk”, not sold separately); for Agent Fetch, user logs into supplier portal via encrypted session; DATEV: DATEV DUO instance, chart of accounts, supplier and tax-code mapping
Per month per plan module; price depends on “the plans and add-ons you select, as well as the number of admin/accountant seats, cards, and the volume of transactions”; “Unlimited employee seats”
From $299/mo (Travel), $349/mo (Accounts Payable), $449/mo (Cards & Expenses), $499/mo (Procurement); Payhawk Complete (full AI Office of the CFO package) – no price listed
US pricing; confirm which plans include Financial Controller Agent.
Data and controls
Where data is stored
Payhawk EOOD processing in “Belgium and Germany (LLMs hosted on Google Cloud)”; blog: data on AWS and GCP “located within the EU”, German users' data in Germany, other EU users in Belgium
Optional sub-processors outside: Duffel (UK, travel); Merge API on AWS EU (Sweden, HR integrations). LLM region within Google Cloud not stated
Does it train AI on your data?
Not used for training – DPA: will not use Controller Personal Data, incl. prompts, “to train, fine-tune, or improve any foundational or general-purpose artificial intelligence models”
AI security FAQ adds that Vertex AI enterprise API “does not use customer data for model training”. DPA wording covers foundational/general-purpose models; Payhawk's own task-specific models not addressed explicitly
Certificates and audit reports
ISO 27001 certified; SOC 2 Type 2 attestation; PCI DSS compliant
Provider blog only; certification body, auditor, scope and report period not stated; not registry-verified. AI security FAQ names no certifications
Additional data conditions
Subprocessors and underlying models
Sub-processors: Payhawk EOOD (platform, Belgium/Germany, LLMs on Google Cloud); Merge API, Inc. (optional HR); Duffel Technology Ltd (optional travel); Invopop (e-invoice processing). LLMs: Google Gemini via Vertex AI
The provider’s own sources say different things here. Contradiction on model versions: AI security FAQ names “Gemini 3.0 Flash”; How Payhawk uses AI names “Gemini 3.1 Flash Lite” or “Gemini 2.5 Flash”. OCR vendors referenced as “vetted third-party vendors (sub-processors)” but not named. Invopop named on help page, not in DPA Schedule 2
Data kept for the Framework Agreement and “deleted 90 days after its expiration or termination, unless the Controller has instructed otherwise”; AI prompts and outputs retained “30 to p60 days”; agent session profile deleted when provider access revoked
Typo on provider page (“30 to p60 days”) – exact AI log retention unclear
Export
DPA cl.9: on written request Payhawk will “destroy or return the Personal Data”; accounting exports to ERP/DATEV (expenses after review, settled payments in real time; receipts to DATEV Belege Online)
Languages supported by the AI agent itself not stated
Approval before posting
Partial – expenses export “once you review them”; “Finance reviews once before export”; payments: extracted details confirmed via “Confirm details”; “Payhawk AI does not execute purchases automatically”; but agent “flags only the exceptions that need a person” when coding
Coding applied without prior review; review gate sits before export. Settled payments export to DATEV in real time. Help page: “some high-confidence tasks run without manual review”
Audit trail
“Payhawk maintains comprehensive audit logs of all actions taken” (timestamps, data sources, confidence levels); “Logs are stored securely and are tamper-evident”
Log retention not stated beyond AI prompts/outputs “30 to p60 days” (typo)
Local requirements
E-invoice processing via Invopop: “ZUGFeRD und XRechnung (Deutschland), Peppol BIS 3.0 (UBL), Factur-X (Frankreich) sowie UBL- und CII-Varianten”; networks Peppol, PPF (France), KSeF (Poland)
GoBD not mentioned on reviewed pages (e-invoicing help, DATEV integration). Not a certification
Questions for the provider
Ask the provider which retention and deletion terms apply, including when the contract ends.
Cost per accepted outcome
Editable hypothetical example · not provider pricing or measured performance. Use this monthly worksheet to test your own quote and quality assumptions.
/ accepted outcome
accepted outcomes / month
5,000 tasks × 80% = 4,000 accepted outcomes per month. Higher entered costs raise unit cost; more accepted outcomes spread the same cost over more results.
Formula: entered monthly costs ÷ (monthly tasks × acceptance % ÷ 100). The numerator includes only the costs you enter. Add applicable licence, usage, integration, human review and rework costs yourself; this is not automatically a fully loaded estimate or a vendor billing model. Capacity released is not realized financial value.
Inputs stay in this browser tab’s session, including reload and language changes. They are not added to the page URL. Continuing prepares an unsent enquiry draft.
A written comparison of up to three AI offerings · €195 net
You get the facts that matter for your decision, each with its source, the questions to ask each vendor and a cost estimate based on your own numbers. First you agree your three most important criteria with Sten Franke.
We deliver your brief by email within a maximum of five working days after payment is confirmed and we have agreed the question and minimum information needed to begin. ETHORITY confirms the start date and delivery date and delivers earlier when the reviewed brief is ready. Missing optional information is recorded and assessed; it does not require you to research the solution yourself. Review before delivery and email support are included.
ETHORITY®