Security

The safest place for your data is a server we never built. Here is exactly how this site is engineered, so you can verify rather than trust.

Your business data never leaves your device

Invoices, customers, prices, your logo — all of it is stored in your browser's local storage on your own phone or computer. There is no database of customer data to breach, because none exists. You can confirm this yourself: open your browser's developer tools and watch the network tab while you work.

Card details are handled by Stripe, never by us

Checkout happens on Stripe's own servers (you'll see the address change to stripe.com). Stripe is a PCI DSS Level 1 certified payment processor — the highest level — and processes payments for millions of businesses. Your card number never touches our infrastructure, and we couldn't see it if we wanted to.

Infrastructure

• Served exclusively over HTTPS with HSTS, on Cloudflare's global edge network.
• Strict security headers on every response: Content-Security-Policy (no third-party scripts — none, ever), frame-ancestors denied, nosniff, and a locked permissions policy (no camera, microphone, or location access).
• Passwords are strengthened on your own device (600,000 rounds of PBKDF2) before they ever leave it, then hashed again on our side — we never see or store your actual password. Optional two-factor authentication (TOTP) and one-tap sign-out-everywhere are built in.
• No analytics scripts, no trackers, no ad networks — nothing watching you.
• Licenses are verified with signed keys; billing status is checked directly against Stripe.

Responsible disclosure

Found a vulnerability? We publish a standard security.txt. Report it via Support — reports are read within one business day and we'll credit you in the changelog if you'd like.