Security you can actually verify
We document our controls in plain language — not marketing, not checkboxes. Verifiable technical decisions made to protect your invoice data.
Transport Security
All connections use enforced HTTPS/TLS. No unencrypted connections are accepted at any endpoint.
Credential Storage
API keys are hashed with bcrypt before storage. We never store plaintext credentials. Integration tokens are AES-256 encrypted at rest.
Data Isolation
Each account's invoice data is stored in isolated partitions. No cross-account queries are possible. Our architecture prevents any data bleed between accounts.
Access Controls
Four-tier RBAC across all features: Owner, Admin, Member, and Read-only. Permissions enforced at the API layer, not just the UI. Every action is logged.
Data Retention
You control exactly how long your invoice data is stored — from 1 day to permanent. Deletion is hard delete, not soft. Automated retention jobs run every 6 hours.
Infrastructure Security
CSRF mitigation via Origin/Referer validation on all state-changing requests. Rate limiting on uploads. Security headers enforced on every response.
Where we are. Where we're going.
We believe in being upfront about our current status and what's on the roadmap. Data deletion, HTTPS, and bcrypt hashing are live today.
Questions about security?
We'll answer any technical security question directly. Email security@invoiceparserpro.com
We respond to all security inquiries within one business day.