Security
Invoices are financial records, so this page says plainly how Invoist stores, protects, and deletes them. No badges, just what the system actually does.
Your documents
Uploaded invoices are stored in private object storage and are only reachable through your workspace. Deleting a document removes the extraction, its review items, and the stored file. Deleting a workspace or an account removes everything in it, including the files. You can also set a retention window, and documents older than it are purged automatically, with every purge written to the audit log.
Credentials and keys
Passwords are hashed with bcrypt and never stored in plain text. Signing in sets an opaque random session token, not anything derived from your details. API keys are stored hashed, so a database read cannot recover them. Tokens for connected accounting platforms are encrypted at rest with AES-256-GCM. Resetting your password signs out every other session. You can turn on two-factor sign-in with an authenticator app, so signing in also needs a code from your phone.
Who can see what
Access is role-based: owners, admins, and members have different rights, and role checks run on the server, not in the interface. For bookkeeping firms, staff see only the clients they are assigned to. Sensitive actions such as deleting a workspace or an account require re-entering your password or typing the workspace name.
An audit trail you can read
Workspace activity is recorded in an append-only audit log: review resolutions, exports, deletions, category changes, API key creation, and retention changes. There is no way to edit or delete an entry. Who did what stays answerable even after someone leaves the workspace.
Webhooks and integrations
Outbound webhooks are signed with HMAC-SHA256 so your systems can verify every delivery came from us. Third-party apps connect through OAuth with explicit scopes, and you can revoke an app's access at any time.
Payment data
Card details go directly to Stripe and never touch our servers. We store the subscription state Stripe reports back, nothing more.
What we do not claim
We do not currently hold a SOC 2 or ISO 27001 certification. We would rather tell you exactly what we do than point at a certificate. If your review requires specific answers about our setup, write to us and we will answer plainly.
Reporting a problem
Found something that looks wrong? Write to [email protected] and we will respond quickly. Please do not test against other people's workspaces.