Security

The safest place for your data is a server we never built. Here is exactly how this site is engineered, so you can verify rather than trust.

Your business data never leaves your device

Invoices, customers, prices, your logo — all of it is stored in your browser's local storage on your own phone or computer. There is no database of customer data to breach, because none exists. You can confirm this yourself: open your browser's developer tools and watch the network tab while you work.

Card details are handled by Stripe, never by us

Checkout happens on Stripe's own servers (you'll see the address change to stripe.com). Stripe is a PCI DSS Level 1 certified payment processor — the highest level — and processes payments for millions of businesses. Your card number never touches our infrastructure, and we couldn't see it if we wanted to.

Infrastructure

• Served exclusively over HTTPS with HSTS, on Cloudflare's global edge network.
• Strict security headers on every response: Content-Security-Policy (no third-party scripts — none, ever), frame-ancestors denied, nosniff, and a locked permissions policy (no camera, microphone, or location access).
• No accounts and no passwords means no credentials to steal or reuse.
• No analytics scripts, no trackers, no ad networks — nothing watching you.
• Licenses are verified with signed keys; billing status is checked directly against Stripe.

Responsible disclosure

Found a vulnerability? We publish a standard security.txt. Report it via Support — reports are read within one business day and we'll credit you in the changelog if you'd like.