Security & Data Protection

Effective Effective date · Last updated Last-updated date · Operated by Legal entity name

1. Our approach to security

At Invoizify, trust is fundamental to our service. Freelancers, consultants, and business owners entrust us with sensitive commercial figures, client names, and billing records. We implement appropriate technical, operational, and organizational security controls designed to safeguard your information against unauthorized access, loss, alteration, or disclosure.

What we mean	What we do not claim
“Encrypted in transit and at rest.” Data is protected using modern cryptographic protocols.	We do not claim our system is “unhackable” or immune to all vulnerabilities; no connected system can guarantee absolute invulnerability.
“Data minimisation.” We collect only what is strictly necessary to generate invoices.	We do not claim “zero storage.” Storing your invoices, bills, and logs is required to run an invoicing platform.
“No sale of customer data.” We never sell your client lists or figures to third parties.	We do not monetize data, but we do share it with essential infrastructure processors (cloud, WhatsApp API) under strict confidentiality.

2. Core security architecture

2.1. Cryptographic Controls

Data in Transit: All traffic between your browser, our web dashboards, and our API servers is encrypted using Transport Layer Security (TLS 1.2 / TLS 1.3). Connections between Invoizify and WhatsApp Cloud APIs use secure HTTPS/TLS webhooks.
Data at Rest: Production databases, cloud storage buckets holding generated PDF invoices, and automated backup snapshots are encrypted at rest using industry-standard AES-256 encryption managed through cloud KMS (Key Management Service).

2.2. Network & Infrastructure Security

Cloud Environment: Invoizify runs on secure virtual private cloud (VPC) infrastructure provided by Cloud host and region.
Network Isolation: Production databases reside within private subnets with no direct exposure to the public internet. Access is restricted strictly to application servers via firewall rules and security groups.
DDoS & WAF Protection: Web traffic passes through a Web Application Firewall (WAF) and automated rate-limiting proxies to mitigate distributed denial-of-service (DDoS) attempts, brute force attacks, and common web application threats (such as SQL injection and cross-site scripting).

2.3. Authentication, Authorization & Access Control

Principle of Least Privilege: Invoizify personnel have access to production environments only on a strict need-to-know basis.
Multi-Factor Authentication (MFA): Mandatory hardware-token or authenticator-based MFA is enforced for all engineering and administrative access to cloud consoles, code repositories, and operational infrastructure.
Secrets Management: API keys, database credentials, and third-party tokens are never committed to source code; they are stored in dedicated cloud secret managers and rotated periodically.

2.4. Document & Invoice Protection

Tenant Isolation: Multi-tenant database logic enforces strict organizational partitioning. Queries are scoped to the authenticated user's organization ID, preventing cross-tenant data leakage.
Temporary File Purging: Inbound media files (such as receipt photos or voice notes) are held in temporary storage and systematically removed once parsing and transcription are verified.
Expiring Document Links: PDF download links generated via WhatsApp leverage time-limited signed URLs (e.g., expiring within PDF link expiry (e.g. 24 hours)) to prevent unauthorized scraping of invoice documents.

2.5. Vulnerability Management & Incident Response

Continuous Patching: Underlying server dependencies, operating system libraries, and container base images are continuously scanned and updated to patch common vulnerabilities and exposures (CVEs).
Incident Response Plan: We maintain an internal incident response framework. In the event of a verified data breach impacting personal data, Invoizify will execute remedial measures, notify affected customers without undue delay, and report the incident to the Indian Computer Emergency Response Team (CERT-In) and the Data Protection Board of India as required under applicable regulations.

3. Shared responsibility: what users must do

Security is a collaborative responsibility. To protect your business data:

Protect Your WhatsApp Access: Lock your mobile device with biometrics or a PIN, enable Two-Step Verification within your WhatsApp settings, and immediately report lost SIM cards to your telecom operator.
Verify Invoice Outputs: Always review generated totals, GST calculations, and client bank account numbers before transmitting invoices to your end-clients.
Phishing Awareness: Invoizify will never ask you for bank account passwords, UPI MPINs, or payment card CVVs over WhatsApp.