Security
How StitchInvoice keeps your data safe
An overview of the controls in place around account access, workspace data, client-facing links, and payments. This page describes what StitchInvoice does today; it is not a certification.
Authentication
Sign-in is handled by Clerk, a dedicated authentication provider. StitchInvoice never stores your password directly. Sessions use secure, signed cookies over HTTPS.
Data in transit
All traffic between your browser, StitchInvoice, and its infrastructure is encrypted with TLS. There is no unencrypted path to your account or workspace data.
Workspace isolation
Every business, client record, and document is scoped to the owning workspace at the database level. Application code enforces owner-scoped access on every read and write, so one workspace cannot see or modify another’s data.
Client portal links
Links sent to your clients use a 256-bit randomly generated token. Only a one-way SHA-256 hash of that token is stored, never the token itself, so a database compromise alone cannot be used to reconstruct a working link. Each link resolves to exactly one document; there is no way to browse or guess into another client’s records.
Payments
Card and payment details are entered directly into Stripe’s hosted Checkout and never pass through StitchInvoice’s servers. StitchInvoice does not store full card numbers.
Infrastructure
StitchInvoice runs on Vercel and Supabase, both of which provide encryption at rest and operate their own independently audited security programs.
Access controls
Production access is restricted to what is needed to operate the service, using scoped credentials rather than broad standing access.
Reporting a concern
If you believe you’ve found a security issue, email us and we’ll respond. Please do not test against other customers’ accounts or data.
Questions
Security questions or reports can be sent to support@stitchinvoice.com. See also our privacy policy.