Security

Plain answers about how we handle your data. Questions? Email support@invoicestars.com.

Payments

• Stripe handles payments. Checkout and billing happen on Stripe's own pages. We never see or store your card number.

Signing in to QuickBooks and Google

• Official sign-in only. You connect QuickBooks on Intuit's page and Google on Google's page. We never see your QuickBooks or Google password.
• Your InvoiceStars login has no password. We email you a one-time sign-in link that expires after 15 minutes. Repeated sign-in attempts are rate-limited.

What we store

• Connection tokens, encrypted. The access tokens QuickBooks and Google give us are encrypted (AES-GCM) before we store them.
• What we need to send review requests. Your account email, business name and settings, and for paid invoices: the customer name, email, invoice number, and whether a request was sent or clicked.
• Not stored: card numbers, bank details, or your QuickBooks and Google passwords.

Disconnecting and deleting

• Disconnect QuickBooks from your dashboard. We revoke our access with Intuit and stop reading your data, and cancel review requests that have not gone out yet.
• Disconnect Google from your dashboard. We revoke our access with Google and delete the stored Google tokens.
• Delete your account anytime from your dashboard (Delete my account). We cancel your subscription right away, revoke our QuickBooks and Google access, and delete your account, settings, review requests and sign-in data. You can also email support@invoicestars.com.

Connection security

• HTTPS everywhere. Every page and API call is encrypted in transit. Plain HTTP is redirected to HTTPS, and browsers are told to use HTTPS only.
• Safe sessions. Sign-in cookies are Secure, HttpOnly and SameSite, and our pages can't be framed by other sites.

InvoiceStars runs on Cloudflare's global network

We host InvoiceStars on Cloudflare's infrastructure. That means:

• DDoS protection. Cloudflare's network automatically absorbs attack traffic before it reaches the app.
• Encrypted connections at the edge. HTTPS is set up at Cloudflare's network, with TLS 1.2 or newer required.
• Web application firewall. Cloudflare's managed firewall rules screen requests for widely exploited attacks.
• Data storage. Your account data is kept in Cloudflare D1, Cloudflare's database service.

Report a problem

If you think you found a security issue, email support@invoicestars.com.