Security

How SwiftInvoicePro handles your data

This page is maintained by Apex Flow Technology Ltd to answer the security and privacy questions we receive most often from hotels, corporate finance teams, and procurement reviewers. It describes the controls currently enabled in the product — not third-party certifications.

Last reviewed 24 July 2026

A note on certifications

SwiftInvoicePro is not currently SOC 2, ISO 27001, or PCI DSS certified, and holds no completed third-party penetration test. A SOC 2 Type 1 engagement is planned at the first paid enterprise deployment.

Inherited infrastructure assurance: the application runs on Cloudflare's edge network with managed PostgreSQL in AWS EU-West (Ireland), and uses Stripe for payments. Cloudflare holds SOC 2 Type II and ISO 27001; Supabase and the underlying AWS platform hold SOC 2 and ISO 27001; Stripe is PCI DSS Level 1 and no card PAN reaches our systems. Those certifications cover the providers' platforms — they do not extend to the SwiftInvoicePro application layer, and Apex Flow Technology Ltd does not claim them as its own.

If your procurement process needs more than this page, the security pack has the whitepaper, a bridge letter explaining the bootstrapped position, and CAIQ / SIG questionnaire responses on request.

Open the security pack →

Controls currently in place

Webhook authentication

Inbound webhooks from partner PMS systems are verified with HMAC-SHA256 using a per-tenant shared secret and a timing-safe comparison. A short-lived nonce cache rejects replayed payloads.

Tenant isolation

Application data is stored in PostgreSQL with row-level security enabled on customer tables. Access policies scope every read and write to the authenticated tenant; a security-definer helper is used for role checks so policies cannot recurse.

Authentication

Customer sign-in is handled by the managed authentication provider used by Lovable Cloud. Session tokens are attached to server requests via middleware and validated on every protected endpoint.

Encryption

All traffic to the application is served over TLS 1.3. Data at rest in the managed Postgres database is encrypted with AES-256 by the hosting provider.

Hosting & runtime

The application runs on Cloudflare's edge network with a managed Postgres backend. Server functions run in isolated per-request contexts; no long-lived server state is kept between requests.

Data residency

The managed database is provisioned in the EU-West region (Ireland). Edge functions execute at the nearest Cloudflare point of presence and do not persist request data outside the database.

Data collection, use, and retention

We collect the data required to compile and issue invoices on your behalf: folio and reservation records forwarded from your PMS, corporate client profiles you upload, and account information for the users you invite. We do not sell customer data and we do not use it to train third-party AI models.

Customer data is retained for the life of your account. On written request we will export your data in machine-readable form and delete it from active systems within 30 days. Encrypted backups age out on the hosting provider's rolling schedule.

Subprocessors

The following third parties process customer data on our behalf.

Cloudflare, Inc.

Edge hosting, DNS, TLS termination

Global edge

Supabase (via Lovable Cloud)

Managed Postgres, authentication, storage

EU-West (Ireland)

Stripe Payments Europe, Ltd.

Payment processing for paid plans

EU / Global

Resend

Transactional email delivery

EU / US

Shared responsibility

Hosting providers

Physical security, network infrastructure, database engine, and certifications of the underlying platform.

SwiftInvoicePro

Application code, authentication flow, tenant isolation policies, webhook signature verification, and secure defaults.

You, the customer

Managing your users and their access, keeping webhook secrets private, and reviewing invoices before they are sent to corporate clients.

Reporting a vulnerability or incident

If you believe you have found a security issue in SwiftInvoicePro, please email us with a description and any steps needed to reproduce. We aim to acknowledge reports within two business days.

richardromero@swiftinvoicepro.com

Please do not include real customer data in your report. We ask researchers to give us a reasonable window to remediate before public disclosure.

Maintained by Apex Flow Technology Ltd, registered in England & Wales (Company No. 17347345).

See also our Privacy Policy and Compliance overview.