Security

1. Where money actually goes

Invco is an integration platform, not a payment provider. Every business connects its own SumUp merchant account, and money moves from the payer to that merchant account directly. Invco never holds, routes, or settles funds, and never sees a card number — all card entry happens on SumUp's own hosted checkout.

In practice: you connect your own SumUp merchant account to Invco. When a client pays an invoice, Invco asks SumUp to open a checkout against your account, and the client is taken to a page hosted and controlled by SumUp. The payment settles from SumUp to your bank on SumUp's payout schedule. There is no point in that flow at which Invco is in possession of the funds, and no Invco balance you have to withdraw from.

This is a deliberate design choice, not a limitation. Holding or routing other people's money is a regulated activity; staying out of the flow keeps Invco a software product and keeps your payouts governed by your own agreement with SumUp rather than by us.

2. Card data

Invco never receives, processes, or stores a card number, CVV, or expiry date. Card entry happens exclusively on SumUp's hosted checkout, which means Invco's own pages never render a card field.

• What we store for a payment: the SumUp checkout reference, the transaction code, the amount and currency, the status, the payment method type (e.g. card / Apple Pay), and a timestamp.
• What we never store: the primary account number (PAN), CVV/CVC, expiry date, cardholder authentication data, or any part of the magnetic stripe or chip.
• Because no cardholder data touches our systems, Invco sits in the lightest PCI-DSS bracket (SAQ A). Your own SumUp account remains subject to whatever SumUp requires of it.

3. Credentials we hold on your behalf

Two kinds of credential are genuinely sensitive: the SumUp API key that lets Invco open checkouts on your merchant account, and the SMTP/IMAP password that lets Invco send and read mail from your own address.

Both are encrypted at rest with AES-256-GCM using a key held outside the database, so a copy of the database alone does not yield them. They are decrypted only in memory, only at the moment they are used, and they are never rendered back to the browser — once saved, a key can be replaced but not read out of the interface.

4. Isolation between customers

Every company is a separate workspace, and every query Invco runs is scoped to the workspace of the signed-in account. A record belonging to another customer is not filtered out of your results after the fact — it is never in scope to begin with, so an id guessed or copied from elsewhere returns a plain 'not found'.

Where you invite someone into a workspace — a colleague, or a client given sight of their own payments — their access is scoped by explicit permissions, and access to anything outside the area they were granted is refused at a single shared checkpoint rather than page by page.

5. Accounts and access

• Passwords are stored only as salted bcrypt hashes; we cannot read yours, and neither can anyone who obtains the database.
• Optional two-factor authentication (TOTP) on your login.
• Email verification is required before an account can be used.
• Sign-in attempts and other sensitive endpoints are rate-limited to blunt credential-stuffing.
• AI assistants connect with a per-user API key that is scoped to your workspace alone and can be revoked in one click.
• Administrative access to production is limited to Invco's founder and is not shared.

6. Data in transit and at rest

All traffic to invco.pro is served over HTTPS (TLS 1.2+), with HTTP redirected. Connections between the application and the database are TLS-encrypted, and the database's underlying storage is encrypted at rest.

Invco runs on Vercel (application) and Supabase (PostgreSQL database and file storage), with the primary database and stored files in AWS's us-east-1 region in the United States. Static assets are served from Vercel's global edge network.

7. Backups and recovery

Three layers, because a backup you have never restored is a hope rather than a backup. Supabase takes its own automated backups with point-in-time recovery. On top of that, Invco takes a nightly logical dump of the entire database plus every stored file, encrypted with AES-256 and written to private off-platform storage so that losing the Supabase account does not mean losing the data.

The nightly job verifies its own output before publishing it: it checks that every table is present with both schema and rows, compares core row counts against the live database, and proves the encrypted archive decrypts. A restore drill is then run into a throwaway database, so the restore path is exercised nightly rather than discovered during an incident.

8. Logging and monitoring

Application and request logs are retained by our hosting providers and are used for debugging and abuse investigation. Payment webhooks are recorded with their idempotency key so a replayed or duplicated notification cannot double-apply, and a reconciliation job re-checks payment state against SumUp so a webhook that never arrives does not leave an invoice wrongly unpaid.

9. Sub-processors

Invco relies on a small number of providers to operate. Each processes data only to provide its service to us. The current list is published in our Privacy Policy and Data Processing Agreement, and includes Vercel (hosting), Supabase (database and file storage), SumUp (payments, as an independent controller), your own email provider, and Google Analytics (usage measurement, only after cookie consent).

10. Incident response

If we become aware of a breach affecting your personal data, we will investigate immediately, contain it, and notify affected customers without undue delay — and, where the law requires it, notify the relevant supervisory authority within 72 hours of becoming aware. Reach us at security@invco.pro for anything security-related.

11. Responsible disclosure

If you believe you have found a vulnerability, please email security@invco.pro with enough detail to reproduce it. We ask that you give us a reasonable opportunity to fix the issue before disclosing it publicly, and that you avoid accessing, modifying, or deleting data belonging to other customers while testing. We will acknowledge your report, keep you updated, and credit you if you would like us to. We will not pursue legal action against researchers who act in good faith under these terms.

12. What we don't claim

Invco is a small, independent product and we would rather be precise than impressive. We do not currently hold SOC 2, ISO 27001, or PCI-DSS Level 1 certification, and we will not imply otherwise. What is described on this page is what is actually implemented; if you need something specific for your own compliance process, ask us and we will tell you honestly whether we have it.