Security is at the core of everything we do at Invorce. We understand that you're trusting us with sensitive business and financial data. We take that responsibility seriously and implement industry-standard security measures to protect your information.
On this page, we're sharing more technical details about our security practices and infrastructure than most companies typically disclose. We believe in transparency and want you to have full confidence in how we protect your data. We're intentionally being open about our tech stack and security measures to build trust with you.
All data transmitted between your browser and our servers is encrypted using TLS 1.3 with modern cipher suites. Sensitive business data is encrypted at rest using AES-256-GCM authenticated encryption, providing both confidentiality and integrity protection against tampering.
Per-Business Key Isolation: Each business has a cryptographically unique 256-bit encryption key generated using a secure random number generator. Your encryption key is itself encrypted with our master key using envelope encryption, meaning database access alone cannot decrypt your data. This architecture enables future key rotation without re-encrypting all data.
Encryption Controllers & Key Management: We've built dedicated encryption controllers that handle all cryptographic operations. When data is retrieved from the database, your encrypted business key is fetched and decrypted in-memory using our master key (which is never stored in the database). This decrypted business key is then used to decrypt the actual field values. The master key exists only in application memory and secure environment variables, completely isolated from the database layer.
Key Caching: To avoid the overhead of repeated key decryption operations, we implement an in-memory cache for decrypted business keys. Once your business key is decrypted, it's held in memory for 5 minutes before being automatically purged. This means subsequent database operations within that window don't require repeated master key decryption, significantly reducing latency while maintaining security. The cache is process-local and never persisted to disk.
Encrypted at Rest: Customer and supplier PII (phone numbers, addresses, company names, tax IDs, VAT numbers), invoice and quote notes, line items, payment records, expense details, mileage logs, time entries, bank account details (account numbers, sort codes, IBAN, SWIFT/BIC), and business payment instructions.
Third-Party API Credentials: Stripe API keys, OAuth refresh tokens, and two-factor authentication TOTP secrets are encrypted using the same AES-256-GCM scheme. These credentials never appear in logs or error reports.
Passwords are hashed using bcrypt with a high work factor before being stored. We never store plain text passwords and cannot see your password at any time.
We use Stripe for payment processing. Your payment card details never touch our servers - they go directly to Stripe, which is PCI-DSS Level 1 certified (the highest level of security certification).
Role-based access control ensures team members only see what they need to see. We implement strict authorization checks on all API endpoints and data queries.
Complete data isolation between businesses. Your data is separated at the database level and multiple validation layers prevent cross-business data access.
We keep all dependencies up to date and regularly audit our codebase for security vulnerabilities. Security patches are applied promptly.
All user input is validated and sanitized on the server. We never trust client-side validation alone and implement comprehensive checks to prevent injection attacks and data manipulation.
Invorce is hosted on secure, reliable infrastructure with:
We are committed to protecting your privacy:
For more details, see our Privacy Policy.
We take security vulnerabilities seriously. If you discover a security issue, please let us know immediately so we can fix it.
Please email security vulnerabilities to:
Please note: We ask that you not publicly disclose the vulnerability until we've had a chance to fix it. This protects our users and gives us time to patch the issue responsibly. Publically disclosing a vulnerability before it is fixed can put our users at risk. However, after a report is fixed, we welcome public disclosure and discussion, and encourage others to learn from the findings.
Invorce complies with relevant data protection and security standards:
If you have questions about our security practices or would like more information, please contact us:
Security concerns:
security@invorce.comGeneral questions:
hello@invorce.com