Security
The safest data is the data we never take. Here is exactly what this site holds, what it does not, and how you can check.
Where your invoices are kept, and what follows your account
Invoices and estimates, and the job photos and notes you keep with each document, are stored in your browser's own storage (local storage and IndexedDB) on your own phone or computer. Without Pro, that is the only place they are. On Pro, with end-to-end encryption on, your invoices, estimates and job notes, your customer list and your saved prices are encrypted on your device before they sync, so if our servers were ever broken into, your customers' names, addresses and prices aren't in what's taken — only encrypted copies are. Job photos stay on your device. What a signed-in account holds readable is your letterhead — company, contact, license, logo, profile picture, tax settings, look and payment handle — so your setup follows you between devices. Check it yourself: open your browser's developer tools and watch the network tab while you work. Signed out, nothing you type into a document is sent to us.
Card details are handled by Stripe, never by us
Checkout happens on Stripe's own servers (you'll see the address change to stripe.com). Stripe is a PCI DSS Level 1 certified payment processor — the highest level — and processes payments for millions of businesses. Your card number never touches our infrastructure: it goes to Stripe, and we never receive it.
Infrastructure
- Served exclusively over HTTPS with HSTS, on Cloudflare's global edge network.
- Strict security headers on every response: Content-Security-Policy (no third-party scripts — none, ever), frame-ancestors denied, nosniff, and a strict permissions policy (no camera, microphone, or location access).
- Passwords are strengthened on your own device (600,000 rounds of PBKDF2) before they ever leave it, then hashed again on our side — we never see or store your actual password. Optional two-factor authentication (TOTP) and one-tap sign-out-everywhere are built in.
- Your spare key — the 24 characters that reset your password if you ever lose your inbox — is made on your own device and never sent to us. We keep only a one-way check made from it, and a reset sends a proof made from it, never the key itself.
- No third-party analytics, no trackers, no ad networks. Our own page count records the page, the referring site and the language — never who you are.
- Licenses are verified with signed keys; billing status is checked directly against Stripe.
End-to-end encryption for what you make (Pro)
On Pro, your invoices, estimates, photos and notes are encrypted on your device before they sync, with a key only your devices hold. We store the encrypted copy, never the key, so we can't read them. Your phone, your Face ID or your spare key can. Your password never opens them, so resetting your password never touches your invoices.
On the website, the code that encrypts your invoices is sent from our server each time you visit, as it is for every website. If our server were ever taken over, changed code could capture your key the next time you visited. The iPhone app's code is fixed in each release and reviewed by Apple. This way of encrypting is called end-to-end encryption.
Your iPhone's own iCloud Backup keeps a copy of the app's data. Apple protects that copy, not us. Our encrypted copy is ours to protect.
In a browser, the key is kept in the browser's own storage, tied to this browser on this device. Any code running on this site can read it there — which is why the disclosure above matters.
Changing the key itself — after a phone is stolen, say — isn't in this version. Removing a passkey or replacing your spare key stops it opening your documents through your account, but the key underneath stays the same: whoever has an old key and also got a copy of your account's encrypted data could still open what that copy holds.
Responsible disclosure
Found a vulnerability? We publish a standard security.txt. Report it via Support — reports are read within one business day and we'll credit you in the changelog if you'd like.