Security
Your money never touches our hands.
The short version: Stripe processes every payment and collects your bank and identity details. Biz Invoice Pay stores your business records — invoices, customers, payments — and keeps each business's data separate from every other.
Who handles your money
Stripe. When a customer pays you, the card details go straight to Stripe's systems. When you connect your bank, your account and identity details go to Stripe through their onboarding flow — not through us, and not into our database.
Payouts go from Stripe to your own bank account. Payout timing is set by Stripe and your account's status. Biz Invoice Pay is a platform business and is not a bank.
What we never store
- Full card numbers — we never see or touch them
- Full bank account numbers
- Anyone's Stripe secret key — sellers only ever need their Biz Invoice Pay API key
Your data
What we store, and how it's separated.
What we store
- Your business profile — name, address, contact details, logo
- Invoices, customers, payments, payouts, and reports you create
- The last 4 digits of your bank account, so you can tell accounts apart
- Team membership and roles
Separated by business
Every record in the system belongs to exactly one business. When you log in, you can only see your own business's data — the separation is enforced on every read and write, not just in the interface. Your invoices, customers, and payouts are never mixed with another shop's.
Team members only see what their role allows: staff can charge cards and send invoices, but payouts and settings stay owner-only.
Accounts
Passwords and sessions.
Passwords
Passwords are hashed with bcrypt (cost factor 12) before they're stored. We never store a password in plain text, and nobody on our side can read yours.
Sessions
Logins create a session stored in a signed, httpOnly cookie — JavaScript in the browser can't read it, which blocks a whole class of token-theft attacks. Sessions expire, and you can sign out everywhere from your account settings.
Report an issue
Found a vulnerability? Tell us.
If you discover a security issue in Biz Invoice Pay, email us and we'll take it seriously. Please include what you found, how to reproduce it, and how to reach you. We won't take legal action against good-faith researchers.
Contact address — to be replaced before launch
Honest status
Where we are.
Biz Invoice Pay is a new platform. We don't hold certifications like SOC 2 or ISO 27001 — and we won't claim them until we've earned them. What we do is keep the architecture simple: Stripe handles money and identity, we handle your business records, and the boundaries between businesses are enforced in code.
As the platform grows, we'll publish this page's updates in the changelog.
Trust is earned one payout at a time.
Create your account, connect your bank through Stripe, and watch your first payout arrive with every payment accounted for.