Where we stand
This page says what we do to protect your data and what we do not claim. We do not hold SOC 2, ISO 27001 or any other security certification. We are a small company, and we would rather tell you plainly what is in place than borrow a badge.
Documents built without an account
The calculators and document generators run in your browser. If you do not sign in, what you type is not uploaded to us. Some tools keep a draft on your own device so a refresh does not lose it, and you can clear it. The browser-only page shows how to confirm this yourself.
Encryption in transit
- The site is served over HTTPS only. Plain HTTP requests are redirected to HTTPS.
- Only TLS 1.2 and TLS 1.3 are accepted.
- HTTP Strict Transport Security is turned on, so browsers keep using HTTPS on later visits.
- Responses carry standard protective headers, including a content security policy that blocks framing by other sites and forbids plugin objects, no-sniff content typing and a strict referrer policy.
Accounts and stored data
- Passwords. Sign-in is handled by a dedicated authentication service. Passwords are stored hashed, never in plain text, and we do not see them.
- Row level security. Row level security is enabled on every table in our database, so a signed-in user can only read and change the rows that belong to them.
- API keys. If you create an API key, only a one-way hash of it is stored, plus a short prefix so you can recognize it. The full key is shown once.
- Webhooks. Webhooks we send to your URL are signed with HMAC SHA-256 so you can check they came from us. The webhook documentation shows how.
- Rate limits. The AI helper, email sending and public endpoints have rate limits to slow down abuse.
Payments
Online payments go through Stripe. When a client pays, they are sent to a checkout page hosted by Stripe and type their card or bank details there. Those details go to Stripe and never touch our servers. We keep references and payment status only. Stripe publishes its own security and compliance information.
Backups and deletion
- The web server has weekly backups.
- You can export your data and delete your account from your account settings. The privacy policy sets out what is kept and for how long.
What we do not claim
- No SOC 2, ISO 27001, PCI DSS attestation or similar audit report. Card data never reaches us, which is why we are not in scope for card storage.
- No uptime guarantee or service level agreement.
- No guarantee that a breach can never happen. No online service can promise that. If something affecting your data did happen, we would tell the people affected.
Report a security issue
If you think you have found a vulnerability, email contact@invoicetools.com with what you found and the steps to reproduce it. Please give us a reasonable chance to fix it before you share details publicly, and do not access other people’s data. Our security.txt file lists the same contact route. We read every report.