How we protect data

Your invoices, clients and payments are the records of your business, so we treat them that way. This page explains, in plain terms, how your data is kept separate from everyone else's, who can reach it, how secrets and payments are handled, where everything is stored, and what rights you have over it.

Our security goals

1. One account can never see or change another account's data.
2. We never touch card data and never hold your money.
3. Payment status is trustworthy. An invoice turns paid only from a verified payment event or a recorded, audited human confirmation.
4. Secrets stay secret. Encrypted at rest, write-only, never logged.
5. Every change is traceable in an audit log.
6. Evidence cannot be changed. Sent documents change only by revision; signed contracts never change.
7. We can always recover from daily, encrypted, regularly tested backups.
8. Personal data is handled lawfully and kept in the EU, and only as long as needed.

We build against recognised standards: OWASP ASVS Level 2 for the web app, API, MCP server and pay pages, the OWASP Top 10 and API Security Top 10, PCI DSS SAQ-A for payments, and the GDPR.

Your account is isolated

Every record that belongs to an account carries that account's id, and the database itself enforces that a request can only read and write rows of the account it is acting for. This is not just a check in our code: it is a rule in the database, so a mistake in one feature cannot expose another account. Records that belong to a business are also limited to the businesses the member can reach.

Ids of records in other accounts behave as if they do not exist: the API answers not_found, so ids do not leak.

Permissions on every surface

Every action, in the web app, REST API, MCP server, CLI, store connectors and the AI agent, needs a permission key, and the check runs on every request. A member can only do what their role allows, inside their business scope. API keys and MCP tokens are limited to their scopes and their creator's current permissions. See Roles and permissions.

Integrations and AI assistants create drafts by default. A person confirms each send unless you choose auto-send for a specific key, automation or store connection. Destructive actions, such as voiding an invoice, always need an explicit confirmation.

Sign-in and sessions

• Email and password with a breached-password check and lockout, Google, Apple, magic links and passkeys. Optional two-factor for everyone. See Sign-in methods and Two-factor and passkeys.
• Secure, HTTP-only session cookies with protection against cross-site request forgery.
• Sensitive actions, such as connecting a payment method, changing billing or deleting a business, ask you to sign in again.
• Sign-in events are written to the audit log with time and IP.

Encryption and secrets

• In transit: every connection to our sites, app, API and MCP server uses HTTPS (TLS).
• Secrets at rest: connection credentials you give us, such as your SMTP password, your own AI key or the tokens for a connected accounting system, are sealed with AES-256-GCM using a key unique to your account. They are write-only: no screen, API call, MCP tool or log ever returns them. The app shows at most that a value is set.
• Passwords are stored only as salted hashes.
• Tokens: pay links, portal links, magic links, invitations, API keys and session tokens are long random values stored only as hashes. Public links are single-purpose, expire and can be revoked. API keys are shown once, when you create them.
• Logs: we never log passwords, tokens, API keys, cookies, sealed values, email bodies or webhook bodies.

Payments: no card data, no holding funds

• Card details are entered only on Stripe's hosted checkout pages. Our servers never receive, store or send card numbers.
• Money goes straight from your client to your own Stripe account, bank or wallet. We never hold it and never take a percentage.
• Saved cards stay at Stripe. We keep only Stripe's ids, the card brand, the last 4 digits and your client's consent.
• An invoice is marked paid only from a verified payment event, a reconciliation with the payment provider, or a payment recorded by a person and written to the audit log. A browser being redirected to a "thank you" page never marks anything paid.
• Incoming payment webhooks are verified by signature, stored, and processed once even if they arrive twice.

See How payments work.

Documents and evidence

• Sent documents are never edited in place. A change creates a revision, so what your client received stays on record. See Revisions.
• Documents and payments are soft-deleted only.
• Every PDF carries a verification QR code that lets anyone check that the document is genuine. See Verification codes.
• Signed contracts are sealed with a hash, checked on every download, and never change.
• Ledger entries are append-only; corrections are reversing entries.

Uploads and client pages

• Logos, payment proofs and receipts are checked for type and size, images are re-encoded, and files are stored privately and served through short-lived signed links.
• Pay pages, the client portal, estimate pages and verification pages run no analytics and no third-party scripts, and are protected against being framed by other sites.
• There are no ads, affiliates or sponsors on the generator, PDFs, pay pages, the portal or client emails.

Backups and recovery

• The database is backed up every day, encrypted before it leaves the server, and stored in the EU.
• We keep 30 daily and 12 monthly backups.
• Every week a backup is restored into a temporary database to prove it works. A failed restore test blocks the next release.

Where your data lives

Production data, files and backups are stored in the EU. Some services we rely on process data elsewhere:

The full, current sub-processor list is in our privacy policy, and business users get notice before it changes.

The visitor invoice generator is different: without an account, your invoices never reach our servers at all. They stay in your browser until you sign up.

Privacy and your rights

• Who is responsible. Genyune (SMC-Private) Limited is the controller for your account data (your login, members and billing). For the data you enter about your own clients, you are the controller and we are your processor, under our Data Processing Agreement.
• Export. The Owner can download everything in the account (JSON, PDFs and CSV) at any time. See Export your data.
• Delete. The Owner can delete the account. It is hidden at once and permanently deleted later. See Delete your account.
• Correct. You edit your own data directly. Sent documents change by revision, which also keeps the legal record.
• Clients' requests. If one of your clients asks us about their data, we pass the request to you, because you are their controller.
• Analytics run only on the marketing site and docs, and only after you consent. Never in the signed-in app, and never on pay, portal or verification pages.

Incidents

We have a written incident response plan. If a personal data breach happens, we notify the supervisory authorities within the GDPR's 72-hour window where required, and tell affected account holders by email and in the app. Where we hold data about your clients as your processor, we tell you without undue delay, so you can meet your own duties to them.

Report a vulnerability

Email [email protected]. The same address is published in our security.txt file at https://freeinvoiceautomation.com/.well-known/security.txt. Please do not test against other users' data. For anything else, contact support.

Related pages