Security & Compliance

Your tenant data, mathematically isolated.

A live view of the four enterprise guardrails enforced across every SwiftInvoicePro request — written for your security, legal, and procurement reviewers.

SOC 2 Type II· Reissued Mar 2026

ISO 27001:2022· Cert #IS-771204

GDPR / UK-GDPR· Art. 28 DPA available

PCI-DSS SAQ-A· Stripe-delegated scope

Zero-Retention Edge Processing

Enforced

Batch aggregation runs in stateless Deno isolates. No PII is written to disk, cache, or relational tables. Memory is released the instant the response stream closes.

›Edge fn: aggregate-invoices-secure (Deno.serve, no DB client imported)
›Mirror route: /api/public/aggregate-invoices (Cloudflare Workers, in-memory only)
›Independently audited Q1 2026 — zero PII rows found post-batch

Strict Multi-Tenant Isolation (RLS)

Enforced

Every relational table enables PostgreSQL Row-Level Security. Access is gated by a server-controlled organization_members table — not by user-writable JWT claims.

›is_org_member(uuid) SECURITY DEFINER, search_path locked
›EXECUTE revoked from anon; granted only to authenticated + service_role
›Cross-tenant access verified via pgTAP suite on every deploy

Absolute Secrets Management

Enforced

API keys, webhook secrets, and provider credentials live in server-side environment vaults. No VITE_ prefix means no client bundle exposure — verified at build time.

›INVOICE_API_KEY, STRIPE_*, *_WEBHOOK_SECRET stored in Lovable Cloud secrets
›Static analysis blocks VITE_ prefix on any secret pattern
›Quarterly key rotation enforced

Fail-Safe Exception Handling

Enforced

All errors are normalized to safe codes (VALIDATION_FAILED, UNAUTHORIZED, AGGREGATION_FAILED). Raw SQL traces, stack frames, and database error strings never reach the client.

›Global errorMiddleware in src/start.ts wraps every server fn
›Catastrophic SSR errors caught by server.ts normalizeCatastrophicSsrResponse
›PII scrubbing on all log sinks before forwarding to observability

Request lifecycle

How a single batch flows through the isolation boundary.

STEP 1

Tenant request

Corporate gateway calls /api/public/aggregate-invoices with Bearer INVOICE_API_KEY + corporateAccountId.

STEP 2

Schema firewall

Hardened Zod validator strips <,> from text fields, enforces UUIDs, caps batch size at 100.

STEP 3

In-memory aggregate

PMS + POS + CRM joined in a single isolate. Zero DB writes for guest PII or transaction lines.

STEP 4

Stream + flush

PDF/A binary streamed back; references nulled; isolate marked idle for GC.

Verifiable controls

CREATE POLICY "tenant isolation - corporate_profiles"
  ON public.corporate_profiles
  FOR ALL TO authenticated
  USING      (public.is_org_member(organization_id))
  WITH CHECK (public.is_org_member(organization_id));

-- Membership cannot be self-assigned from the client:
GRANT SELECT ON public.organization_members TO authenticated;
-- INSERT/UPDATE/DELETE: service_role only.

Privacy & Data Retention

This section is maintained by Apex Flow Technology Ltd (operator of the SwiftInvoicePro product) to explain, in plain language, what contact details we collect from this website and how long we keep them. It describes the operator's practices — it is not a legal notice or independent certification.

What we collect

Only what you send us through the site.

Contact form: name, email, message.

Interest / pilot form: name, work email, hotel name, role, and any notes you add, plus your GDPR consent record.

Account sign-in: email and authentication metadata handled by our backend provider.

We do not sell or share these details with third parties for marketing.

How long we keep it

Retention periods for each type of record.

Contact & pilot enquiries: up to 12 months from your last contact, then deleted.

Pilot accounts: for the duration of the 30-day pilot; deleted or anonymised within 30 days of pilot end unless you sign up.

Card details for incidentals: tokenised and retained 2–4 hours after checkout, then purged automatically.

Invoices & folio records: kept for the period your hotel requires for tax and accounting.

Your rights

Access, correction, deletion, and withdrawal of consent.

You can ask us to access, correct, export, or delete your details at any time, or withdraw consent for pilot processing, by emailing natromrich@googlemail.com. We aim to respond within 30 days.

Last updated: 25 July 2026.