Our approach
InvoFlow is built for teams handling financial documents. Security is not a bolt-on: tenant isolation, least-privilege access, and audit trails are part of the core architecture. This page summarises our practices for customers and users. For privacy rights and data categories, see our Privacy Policy.
Infrastructure
InvoFlow runs on industry-standard cloud infrastructure hosted in the UK and/or EU. Separate providers handle application hosting, database and authentication, private file storage, and document processing for receipt extraction. All are bound by contractual security obligations.
All browser traffic to InvoFlow uses HTTPS (TLS) in production. Receipt images sent for extraction are processed under strict API terms and are not used to train public models on your behalf.
Tenant isolation
InvoFlow is multi-tenant: many organisations share one application, but each organisation's data is logically separated.
- Database-level access controls enforce organisation boundaries, not only in application code. Even if a query forgets a filter, the database refuses cross-organisation access.
- Customer data tables are protected with organisation-scoped access rules.
- Receipt files are stored privately; they are not public URLs. Access is tied to organisation membership and expense visibility rules.
Access control and roles
Within an organisation, access follows role-based rules:
| Role | Typical access |
|---|---|
| Standard user | Own claims and receipts only |
| Finance admin | Org-wide claims; approve others' submissions |
| Account admin | Org-wide visibility; team and settings management |
Approval actions are restricted by role and segregation-of-duties rules (for example finance users cannot approve their own claims). Sensitive write operations are enforced in the database, not only in the user interface.
Authentication
- Email and password sign-in via our authentication provider
- Passwords stored hashed; InvoFlow never sees plain-text passwords
- Session tokens refreshed on each request; unauthenticated users cannot reach app pages
- Multi-factor authentication (MFA) for privileged roles is on our roadmap and is not yet enabled
Audit trail
Finance decisions (approve, reject, request more information) are stored as immutable records linked to claims, not overwritten when status changes. This supports accountability and internal review.
What we do not do
- We do not store payment card data: no card numbers, CVV, or expiry in InvoFlow
- We do not sell customer data
- We do not expose receipt files via public links
Subprocessors
We use vetted third-party providers for hosting, data storage, authentication, document processing, and payments. Payment providers include GoCardless (GoCardless Ltd) for subscription billing and TrueLayer (TrueLayer Ireland Limited or TrueLayer Limited) for open-banking reimbursements on team plans.
A full list with locations and purposes is in our Privacy Policy. We update that list when vendors change materially.
Payments and open banking
InvoFlow uses regulated third-party payment providers (not card rails) for two separate flows:
- Subscription billing (GoCardless): UK Direct Debit for InvoFlow plan fees. You set up a mandate on GoCardless's hosted pages; InvoFlow stores mandate and subscription status, not your full bank credentials.
- Reimbursement payouts (TrueLayer): on team plans, finance users can initiate open-banking bank transfers to reimburse approved claims. Bank login and strong customer authentication stay at your bank; InvoFlow records payment status and audit data only.
Controls in place today include:
- Payment amounts and payee details set server-side, not by the browser
- Signed webhooks and verified return URIs for payment status updates
- Encrypted payee bank details at rest; admins see masked references only
- Confirmation of Payee checks before reimbursement where enabled
- Immutable payment audit records retained for compliance
Provider terms apply when you use these features. See our Terms of Service section 5 and Privacy Policy subprocessors list.
Compliance and certifications
- We design for UK GDPR and sensible security baselines (including OWASP-aware development)
- ISO 27001: we align our security management programme with ISO 27001 principles and are working towards formal certification. We do not claim certification until an audit is complete.
- Customers with specific compliance questionnaires can contact us; we will answer honestly about current vs planned controls
Operational security
- Infrastructure and application changes go through reviewed, versioned releases
- Secrets kept server-side, not in browser bundles
- Regular dependency updates as part of normal development
- Security review before releases that expand data access or storage
Report a vulnerability
If you believe you have found a security issue, please report it responsibly to security@invoflow.uk. Include steps to reproduce and impact. We aim to acknowledge reports within a few business days.
Please do not publicly disclose issues until we have had a reasonable opportunity to investigate and remediate.
Contact
Security enquiries: security@invoflow.uk
Privacy enquiries: privacy@invoflow.uk
