Security

How SwiftInvoicePro handles your data

This page is maintained by Apex Flow Technology Ltd to answer the security and privacy questions we receive most often from hotels, corporate finance teams, and procurement reviewers. It describes the controls currently enabled in the product — not third-party certifications.

Last reviewed 24 July 2026

A note on certifications

SwiftInvoicePro is not currently SOC 2, ISO 27001, or PCI DSS certified. A SOC 2 Type 1 engagement is planned once the product is running in production for more than ten paying customers.

Some underlying providers (Cloudflare, Supabase, Stripe) hold their own certifications for the infrastructure they operate. Those certifications cover the provider's platform — they do not extend to SwiftInvoicePro itself. If your procurement process requires attestations, contact us and we will share what we can under NDA.

Controls currently in place

Webhook authentication
Inbound webhooks from partner PMS systems are verified with HMAC-SHA256 using a per-tenant shared secret and a timing-safe comparison. A short-lived nonce cache rejects replayed payloads.
Tenant isolation
Application data is stored in PostgreSQL with row-level security enabled on customer tables. Access policies scope every read and write to the authenticated tenant; a security-definer helper is used for role checks so policies cannot recurse.
Authentication
Customer sign-in is handled by the managed authentication provider used by Lovable Cloud. Session tokens are attached to server requests via middleware and validated on every protected endpoint.
Encryption
All traffic to the application is served over TLS 1.3. Data at rest in the managed Postgres database is encrypted with AES-256 by the hosting provider.
Hosting & runtime
The application runs on Cloudflare's edge network with a managed Postgres backend. Server functions run in isolated per-request contexts; no long-lived server state is kept between requests.
Data residency
The managed database is provisioned in the EU-West region (Ireland). Edge functions execute at the nearest Cloudflare point of presence and do not persist request data outside the database.

Data collection, use, and retention

We collect the data required to compile and issue invoices on your behalf: folio and reservation records forwarded from your PMS, corporate client profiles you upload, and account information for the users you invite. We do not sell customer data and we do not use it to train third-party AI models.

Customer data is retained for the life of your account. On written request we will export your data in machine-readable form and delete it from active systems within 30 days. Encrypted backups age out on the hosting provider's rolling schedule.

Subprocessors

The following third parties process customer data on our behalf.

Cloudflare, Inc.
Edge hosting, DNS, TLS termination
Global edge
Supabase (via Lovable Cloud)
Managed Postgres, authentication, storage
EU-West (Ireland)
Stripe Payments Europe, Ltd.
Payment processing for paid plans
EU / Global
Resend
Transactional email delivery
EU / US

Shared responsibility

Hosting providers
Physical security, network infrastructure, database engine, and certifications of the underlying platform.
SwiftInvoicePro
Application code, authentication flow, tenant isolation policies, webhook signature verification, and secure defaults.
You, the customer
Managing your users and their access, keeping webhook secrets private, and reviewing invoices before they are sent to corporate clients.

Reporting a vulnerability or incident

If you believe you have found a security issue in SwiftInvoicePro, please email us with a description and any steps needed to reproduce. We aim to acknowledge reports within two business days.

natromrich@googlemail.com

Please do not include real customer data in your report. We ask researchers to give us a reasonable window to remediate before public disclosure.

Maintained by Apex Flow Technology Ltd, registered in England & Wales (Company No. 17347345).

See also our Privacy Policy and Compliance overview.