Security & privacy
How Invoflux keeps your data, bank connections, and account secure.
- Is my data secure?Yes. Your data is encrypted in transit and at rest and hosted in the EU. Your bank login is never stored and bank access is read-only. Invoflux reads only what it needs from Google and never sends email as you. Your invoice files stay in your own cloud, and you can export or delete your data anytime.
- How your bank connection is protectedYour bank login is never stored or shared with us. Bank connections are read-only and encrypted with 256-bit encryption, through a licensed, EU-regulated open banking provider. Invoflux is PSD2 compliant.
- What Invoflux can access in your Google accountInvoflux requests the minimum Google permissions needed to find invoices in Gmail and file them in Drive. It never sends email from your account and never reads or changes unrelated files in your Drive. You can revoke access anytime.
- Where your data is stored and who can see itYour data is stored encrypted and hosted in the EU. Invoices are also mirrored into your own cloud, which you control. Each company is a separate workspace with no data shared between companies, and people only see what their role allows (your accountant is read-only).
- How we protect your account sign-inYou sign in with Google or Apple, or with a one-time magic link, so there is no password to leak. Sessions are encrypted, and only valid email addresses can create an account. Access to your workspace is controlled by roles.
- Your privacy and GDPR rightsInvoflux handles your data under GDPR. You can access, export, and delete your data at any time. This article explains your rights and links to the full privacy policy and the deletion guides.
- Delete your data or accountYou can delete your Invoflux data or your whole account from Settings under Data and privacy. Deleting removes your data from Invoflux; invoice files already mirrored to your own cloud stay in your cloud, under your control.
- Our security practicesFor the detail-minded: Invoflux encrypts data in transit and at rest, hosts in the EU, is Google CASA Tier 2 certified, runs regular independent security testing, and rotates secrets on a schedule.
- Connecting supplier portals safelyWhen Invoflux fetches invoices from supplier portals, the browser extension runs in your own already-signed-in session, so no portal passwords are shared with us. Any stored portal credentials are encrypted with AES-256-GCM.