InvoiceReconcile handles financial workflow data that deserves careful treatment. Our security program is designed to limit access, protect data through its lifecycle, and preserve a reviewable record of reconciliation actions.
Security is a shared responsibility. This page explains our safeguards and the steps customers should take to protect their workspaces.
You control the financial decision
InvoiceReconcile suggests matches and explains the signals behind them. It does not automatically post changes to your accounting records. A user must review and confirm reconciliation results before export or any supported write-back action.
Confidence labels are not guarantees. Verify amounts, dates, customer identity, invoice references, fees, duplicates, and currency before relying on a result.
Security safeguards
- Workspace isolation: organization and workspace authorization is enforced on the server and in the data layer, with row-level controls where supported.
- Least-privilege access: role checks limit user and administrative access to what is needed for the task.
- Private file handling: selected files are validated on the server and are not exposed through public file URLs. Files on the synchronous path are processed in request memory without a deliberate application-storage copy. Background sources are stored temporarily in a private bucket, marked for deletion after processing once the signed upload capability expires, and covered by a 24-hour cleanup schedule with retries until removal is confirmed.
- Encryption: supported production infrastructure encrypts network traffic in transit and stored data at rest.
- Authentication and sessions: secure authentication, session validation, and protected recovery flows are used for account access.
- Secrets and integrations: service credentials, payment keys, and integration tokens are kept in protected server-side configuration and are not exposed to browser code.
- Input protection: file type, size, and content checks reduce risk from unsafe uploads. Rate limits and request validation protect sensitive endpoints.
- Verified events: supported payment and integration webhooks require signature verification before processing.
- Auditability: persisted imports, reconciliation runs, and reviewer decisions are recorded with actor and timing information to support review and investigation.
- Secure development: dependencies are maintained, changes are reviewed, and security-sensitive flows are tested as part of the release process.
Data minimization and administrative access
We collect and retain data needed to provide and protect the Service. Background source bytes are held temporarily in private storage and scheduled for removal after processing once the short-lived upload capability expires. Any source still present enters the 24-hour cleanup schedule, and deletion remains pending until the storage provider confirms removal. Structured source rows and reconciliation records remain Customer Content under the account retention policy. Customers can request a verified data export or deletion by contacting support@invoicereconcile.com.
Internal product and revenue analytics are designed to use counts, statuses, and operational metadata rather than customer financial values. Authorized personnel may access customer data only when needed for support, security, legal compliance, or service operations, and access should be logged and reviewed.
We do not use Customer Content to train general-purpose artificial intelligence models unless a customer gives express written permission for that separate use.
Service providers
We rely on selected providers for infrastructure, authentication, storage, billing, email, monitoring, and other operations. We assess providers based on the data they handle, limit access to the service they perform, and use contractual privacy and security obligations appropriate to the relationship.
Third-party services you connect have their own security practices. Review their permissions and remove integrations you no longer use.
Incident response
We evaluate reported or detected security events, take proportionate steps to contain and remediate confirmed incidents, preserve relevant evidence where appropriate, and provide legally required notices.
If you suspect unauthorized access, revoke exposed credentials where possible, preserve relevant details, and contact support@invoicereconcile.com promptly.
Report a vulnerability
Send vulnerability reports to support@invoicereconcile.com with the affected URL or feature, steps to reproduce, potential impact, and any supporting evidence. Do not include real customer financial data in the report.
Do not access another user's data, disrupt the Service, use social engineering, run denial-of-service tests, or publicly disclose an unresolved issue. Stop testing and contact us if you encounter data that is not yours. We will acknowledge a good-faith report and coordinate next steps, but we do not currently operate a paid bug bounty program.
Customer responsibilities
- Use a unique password and secure the email account used for sign-in.
- Give each person an individual account and the minimum workspace role they need.
- Remove former team members promptly and review access regularly.
- Confirm that imported files belong to the correct client and workspace.
- Do not upload online-banking credentials, complete card numbers, government identifiers, or other data the Service does not request.
- Protect downloaded exports and devices that store them.
- Review match explanations and source records before confirming or exporting a reconciliation.
- Report suspected compromise promptly to support@invoicereconcile.com.
Security assurance
We do not currently claim SOC 2 certification, ISO 27001 certification, PCI certification, HIPAA compliance, or any other third-party security certification unless a current, verifiable statement is added here after completion of the relevant assessment.
This page describes security practices, not a guarantee that incidents will never occur. Specific enterprise commitments, if offered, must be documented in a signed agreement.
Security contact
Security questions and reports may be sent to support@invoicereconcile.com.