Security

Invoicing data is financial data. Here’s how we protect it.

HTTPS everywhere

All traffic to Invoala is encrypted in transit with TLS, and HSTS is enabled so browsers refuse plain-HTTP connections.

Private by default

The generator stores your data in your browser until you create an account. Account data lives in your private dashboard only — never in search results or public pages.

Secure authentication

Passwords are hashed with scrypt and per-user salts, sessions use signed, HttpOnly cookies, and login endpoints are rate limited.

Storage

Account data is stored in a managed SQLite database (Turso) over encrypted connections. Databases are protected by access tokens that live only in server-side environment variables.

Shared invoices

Invoice share links require a secure token and expose only the specific invoice you choose to share — nothing else.

No trackers

Invoala does not use advertising trackers. Analytics, if enabled, are opt-in via our cookie consent and never sold.

Your responsibilities

Use a strong, unique password for your Invoala account, and don’t share invoice links beyond the people who should see them. See our Privacy Policy and Terms of Service for the full picture.

Report a vulnerability

Found a security issue? Email hello@invoala.com — we take reports seriously and respond promptly.