Agent Invoice is built so that sensitive payment card data never touches our servers. Here's how payment security works on the platform.
1. We Don't Store Card Numbers
When a client pays an invoice, they're taken to a secure checkout hosted directly by Stripe or PayPal. Card numbers, CVVs, and full bank account details are entered on the payment processor's own infrastructure and never pass through Agent Invoice's servers or database.
2. PCI DSS
Stripe and PayPal are independently certified as PCI DSS Level 1 service providers - the highest level of certification under the Payment Card Industry Data Security Standard. Because card data is captured and processed entirely on their infrastructure, Agent Invoice's own PCI scope is minimized accordingly. We do not claim independent PCI certification for Agent Invoice itself.
3. Encryption
- In transit: all connections to Agent Invoice use TLS (HTTPS), commonly referred to as 256-bit encryption.
- At rest: data stored in our database is encrypted at rest by our hosting provider, Supabase.
4. Infrastructure
Agent Invoice is hosted on Vercel and Supabase. Both providers publish their own independent security and compliance documentation, including SOC 2 reporting - see their respective trust and security pages for current details.
5. API Key Security
Developer API keys are shown to you only once at creation and stored in hashed form thereafter. You can regenerate your API key at any time from Settings, which immediately invalidates the previous key.
6. Reporting a Vulnerability
If you believe you've found a security issue in Agent Invoice, please email support@agent-invoice.com with details. We ask that you give us a reasonable opportunity to investigate and address any issue before public disclosure, and that you avoid accessing or modifying data that isn't yours while testing.
7. Contact
Security or compliance questions? Email support@agent-invoice.com.