InvioInvio

Security at Invio

Your invoices, clients and bank details are sensitive. This page says plainly where they live, how they are protected, and what we do not have yet.

Invio is run by an individual New Zealand sole trader, Bakhtiyar Duganov trading as Invio. We have no SOC 2 report, no ISO 27001 certificate and no external penetration test. What follows is what the code does today.

Where your data lives

Database
Your account, business, client, invoice, quote and payment records are held in MongoDB Atlas, in Sydney, Australia.
Application
The Invio web app and its API run on Vercel. Vercel runs them in the United States by default, and our configuration does not change that.
Files
Logos, receipts and other uploads are stored with Cloudflare R2. Receipts and avatars sit in a private bucket. Cloudflare's network is global and we do not pin storage to one country.
Email
Invoices, reminders and account emails are sent through Brevo, using its infrastructure in France, Germany and Belgium.
Errors and analytics
Error reports go to Sentry in Germany. Product analytics go to PostHog on its EU cloud.

The full list of providers, what each one does and where it processes data is on the Subprocessors page.

How it is protected

In transit
Invio is served over HTTPS, and browsers are told to keep using HTTPS (an HSTS header with a 180-day lifetime).
At rest
MongoDB states that Atlas encrypts all cluster storage at rest by default (MongoDB's documentation). That is the layer under your records. We have not added a separate encryption layer over ordinary invoice data.
Connection tokens
Xero refresh tokens and two-step sign-in secrets get an extra layer: they are encrypted inside Invio with AES-256-GCM, each under its own key, before they are stored.
Passwords and codes
Passwords are stored as bcrypt hashes, never as text. Password reset links, email verification codes and connector tokens are stored only as hashes too.
Clickjacking
Pages cannot be embedded in other sites, except the public enquiry form that is built to be embedded.

Accounts and access

Password rules
New passwords need at least 12 characters, a letter and a number, must not be on a list of common passwords, and must not contain the first part of your email address.
Sign-in throttling
Sign-in attempts are limited to 10 an hour from one address.
Two-step sign-in
Optional, using any authenticator app (time-based codes), with 10 single-use recovery codes. Turning it on signs out every other device.
Sessions
A sign-in lasts up to 30 days. It ends on the next request after a password change, after two-step is turned on, or if the account is suspended.
Team roles
A business can invite people as admin, staff, accountant, contractor or worker. Each role can do only what its permissions list allows, and the check runs on the server for every request.
Owner-only settings
Bank account details, tax identity, region, numbering and how the business gets paid can be changed by the owner only. A changed bank number on an invoice is the classic payment-redirection fraud, so nobody else can change it.
Bank feed codes
The automatic bank feed is built to ask for a one-time code emailed to you (valid 10 minutes, 5 tries) before it opens, and that approval lasts 12 hours on the browser you used. The feed is not open to everyone yet.
Audit log
Changes to business settings are written to an audit log with who made them, whether a person, a connected assistant or our admin. Bank and tax numbers are masked in it.

Keeping businesses apart

Business data belongs to an owner account and a business. Team routes go through one shared check that works out whose business a request is for from the signed-in person, never from anything the request says, and then confirms the role is allowed to do that action. If a permission is not listed for a role, the answer is no.

AI features and your data

Invio uses AI providers for the features below. Where a provider is chosen by us, it can change, and the Subprocessors page is kept current.

Voice invoices and Offsider
These use Google Cloud (Vertex AI) and only when you use them. Voice recordings are not stored. The text of Offsider chats and voice invoices is kept for 30 days so we can check and improve the answers, then deleted automatically.
Receipt scanning
The receipts you ask Invio to scan are read by Anthropic (Claude) or Google, whichever Invio has selected at the time.
PDF bank statements
If you import a PDF statement, the PDF is sent to Anthropic to be read into lines. Invio does not keep the PDF or the reply.
Weekly business summary
Once a week a one-line description of what each business does is written for our internal customer list, from the business name and its invoice line descriptions.
Address suggestions
The text you type into an address field is sent to Google Places to suggest matches. Only the address you pick is stored.
Your own assistant
If you connect your own AI assistant to Invio, it acts through a connector token you can revoke at any time in Settings. The Xero connector has its own page, linked below.

Anthropic's processing location and how long it keeps requests are not verified by us, and we make no claim about either. How the Xero connector handles drafted changes, approvals and retention is on the connector security page.

Payments

Card payments and subscriptions run through Stripe. Card details are entered on Stripe's checkout pages and are not stored by Invio. Stripe's notifications are verified with a signing secret before they change anything.

Backups and deletion

The database is copied twice a day by a scheduled job, compressed, encrypted with AES-256-GCM and written to a private Cloudflare R2 bucket. How long backups are kept is set out in the privacy policy.

If you delete your account, it is scheduled for deletion and removed after 30 days unless you cancel. Businesses that keep care or worker records are told about their own record-keeping duties and offered a full export first. Deleted data can remain in a backup until that backup ages out.

Monitoring

Unhandled errors in the app are captured in Sentry so we can find and fix them. We do not run a round-the-clock security operations team. Invio is one person plus tooling.

What we do not have yet

No SOC 2 report. No ISO 27001 certificate. No external penetration test. Our reviews so far are our own code reviews, automated tests and dependency checks. Our Content-Security-Policy currently reports problems rather than blocking them.

If your business needs a security questionnaire answered, email support@invio.co.nz. We are happy to answer one.

Reporting a vulnerability

If you think you have found a security problem, email support@invio.co.nz with "Security" in the subject and enough detail to reproduce it. Please do not access other people's data or disrupt the service while testing. We read every report. Our machine-readable contact file is at /.well-known/security.txt.

Common questions

Is my data used to train AI models?
Not by Invio. For the providers we send data to: Google states it will not use your data to train or fine-tune models without your prior permission (Google's data governance page), and Anthropic states that by default it does not use inputs or outputs from its commercial products for training (Anthropic's explanation). Those are their statements and their terms can change, so check them if it matters to you.
Where does Anthropic process my data, and how long does it keep it?
Not verified. Anthropic is a United States company. We have not yet checked where it processes API requests or how long it keeps what it receives, so we make no claim about either. Our subprocessors page says the same.
Do you store my card details?
No. Card payments and subscriptions are handled by Stripe on Stripe's own checkout pages. Invio does not receive or store card numbers. Stripe's messages to Invio about a payment are checked against a signing secret before we act on them.
Can I get a security questionnaire answered?
Yes. Email support@invio.co.nz and we will answer it as honestly as we can. Where the answer is that we do not have something, we will say so.
Security at Invio | Invio