Security

Invollc holds your invoices, your clients and, if you connect it, read access to your business bank. Here is what we do to protect it, written plainly. If you have a question that isn't answered here, ask.

1Your account

• Passwords are stored only as a one-way hash. Nobody at Invollc can read them.
• Sign-in, sign-up and password reset are rate-limited and protected by Google reCAPTCHA, which stops password guessing and automated sign-ups.
• Every request is checked against the account that owns the data. Automated tests verify that one account can't read or link another account's clients, invoices or bank details.
• API keys can be limited to reading invoices, and a limited key can't reach the rest of the app.

2Bank connections

• For Mercury we ask for a read-only API token. With it Invollc can list incoming transactions; it cannot send money, change your account or see your login.
• Tokens are encrypted in our database and never sent back to the browser after you save them.
• You can disconnect at any time from Settings. You can also revoke the token from your bank's dashboard, which cuts access immediately.
• Notifications from banks and from Stripe are accepted only if their cryptographic signature checks out.

3Payments

• Subscriptions are paid through Stripe Checkout. Your card number goes to Stripe, not to us.
• When your clients pay an invoice, the money goes to your own account at Stripe, Mercury or your bank. Invollc never holds funds.

4Your data

• Your data belongs to you. You can export invoices, payments and expenses as CSV and download every PDF, even after a trial ends.
• We don't sell data, we don't use it for advertising and we don't use your business records to train AI models.
• Links to invoice PDFs expire after a few minutes. Public invoice links use long random codes that can't be guessed.
• The full list of providers that process data for us is in the Privacy Policy.

5Infrastructure

• All traffic is encrypted with HTTPS.
• The servers sit behind a firewall that only exposes the web ports. The database isn't reachable from the internet.
• Security updates for the operating system are installed automatically.
• The database is backed up every day.

6Reporting a problem

If you think you found a security issue, write to info@auderesoftware.com with the details. Please don't access other people's data or disrupt the service while testing. We'll reply, keep you updated while we fix it, and credit you if you want.