Trust & Security

InvoiceFlow uses email and password sign-in. Passwords are checked against the Have I Been Pwned database at signup and password change, so known-breached passwords are rejected.

Sessions are managed by the underlying backend platform and automatically refresh while you are signed in.

Your clients, invoices, and subscription plan are scoped to your account at the database level using row-level security. The database rejects reads or writes targeting another user's rows, independent of the app code.

Subscription plan changes are not writable from the browser; only trusted server-side code can change a plan tier.

We store the data you enter to operate the app: your email and password hash (managed by the auth provider), your clients (name, contact, GSTIN, address), and your invoices (line items, amounts, GST breakdown, status).

We do not store payment card details — when payments are enabled, they are processed by a third-party payment provider.

The app and its API are served over HTTPS. Data is stored in a managed Postgres database provided by our backend platform.

To request export or deletion of your data, or to report a security concern, contact the InvoiceFlow team using the email address on your account.