Security

PayInvoix handles your invoices, your clients, and money moving between them — so security isn't a feature, it's the foundation. Here's how we protect your account and your data.

Payments — we never touch card details

All payments run through Stripe using their hosted checkout and customer portal. Card numbers are entered on Stripe's own PCI-compliant pages — they never pass through PayInvoix. We store only Stripe identifiers and billing status, never full card numbers. When your clients pay an invoice online, the money goes directly to you through your own connected Stripe account; it never sits with us.

Your data is isolated from everyone else's

Every table in our database enforces row-level security, so your account can only ever read and write its own records. One customer's data is never visible to another, and this is enforced at the database layer — not just in the app.

Encryption

All traffic to and from PayInvoix is encrypted in transit over HTTPS/TLS. Your data at rest is stored with our infrastructure providers (Supabase/Postgres), which encrypt stored data on our behalf.

Accounts and authentication

• Passwords are never stored in plain text — only as secure, one-way hashes, managed by Supabase Auth.
• Password resets use single-use, time-limited links sent to your verified email address.
• Public invoice payment links use random, unguessable tokens and are not indexed by search engines.

Payment webhooks are verified

Payment and subscription updates arrive from Stripe as signed webhooks. We verify every signature before acting on an event, so forged payment notifications are rejected.

Infrastructure

PayInvoix runs on established, security-focused providers — Vercel for application hosting and Supabase for the database and authentication — each maintaining their own compliance and physical-security programs.

Reporting a vulnerability

Found a security issue? We appreciate responsible disclosure. Email security@payinvoix.com with the details and we'll respond as quickly as we can. Please give us a reasonable chance to fix it before disclosing publicly.

For how we collect and use data, see our Privacy Policy.