How we keep your account safe.
Your invoices and your clients’ details deserve real protection. Here is exactly what we do, what you can do, and how to report a problem.
Last updated 18 October 2026
1. Secure connections
Every page of WhizInvoice is served over HTTPS, so data is encrypted on its way between your browser and our servers. The app uses HSTS, which tells your browser to only ever connect to it securely.
2. Passwords
- We store passwords only as Argon2id hashes. We never store the password itself.
- Passwords must be at least 10 characters long and include a capital letter, a small letter and a special character.
- On the live app, we check new passwords against passwords known from past data breaches, using the k-anonymity range method. Only a short prefix of a hash of your password is sent for the check, never the password itself.
3. Signing in
- We verify your email address by sending you a code.
- You can turn on two factor sign in with an authenticator app. We store its secret encrypted.
- We limit sign in attempts to 5 a minute for each email address and IP address, and 30 an hour from any one IP address. New sign ups are limited to 5 an hour from any one IP address.
- Your session cookie is encrypted, sent only over secure connections, hidden from scripts on the page, and not sent with requests that start on other websites.
4. Keeping accounts apart
Each account’s data is separated at the application level. Automated tests run on every release to check that one account can never read another account’s data.
5. Website connections
- The secrets that link your websites to your account are encrypted at rest.
- Every request from the WordPress connector is signed with HMAC SHA-256.
- Requests older than 5 minutes are rejected, so a captured request cannot be replayed later.
6. Billing
Payments are handled by Freemius, our reseller and merchant of record. Your card details never touch our servers. The billing messages Freemius sends to us are signature checked, and we reject any that fail.
7. In your browser
- A strict Content Security Policy controls which scripts and resources app pages can load.
- App pages cannot be shown inside frames on other websites, which protects against clickjacking.
- App pages are never stored by shared caches, such as proxies or content delivery networks.
8. On our servers
Our application code and secrets sit outside the public web folder, so they cannot be reached from the web. Your data is stored on servers in Frankfurt, Germany, in the European Union.
9. Audit logs
We keep an audit log of sign ins, billing changes and security events, so we can spot and investigate anything unusual. Audit logs are kept for 12 months.
10. What you can do
- Use a long, unique password, and turn on two factor sign in.
- Invite each team member with their own login, and remove people when they leave.
- Keep the WhizInvoice connector and the rest of your WordPress site up to date.
- Tell us straight away at security@whizinvoice.com if you think someone has used your account.
11. Reporting a vulnerability
If you think you have found a security problem in WhizInvoice, please email security@whizinvoice.com. Include what you found, where, the steps to reproduce it, and how it could affect our users. We will confirm we have your report, keep you updated while we fix it, and let you know when it is fixed.
In scope: app.whizinvoice.com, whizinvoice.com and the WhizInvoice connector plugin for WordPress. Out of scope: the systems of our providers, such as Freemius, Hostinger and Brevo, which you should report to them directly.
12. Safe harbour for good faith research
We welcome research that follows these rules:
- test only against accounts you created yourself, and never access, change or delete anyone else’s data;
- if you come across someone else’s data by accident, stop, do not keep or share it, and tell us straight away;
- do not degrade the service for others, so no denial of service, load or volume testing, and no spam;
- do not use social engineering, phishing or physical attacks against us, our users or our providers;
- give us a reasonable time to fix the problem before you share any details publicly, and talk to us before you publish.
If you follow these rules in good faith, we will consider your research authorised. We will not take legal action against you or ask law enforcement to act against you because of it. If someone else takes action against you over research that followed these rules, we will make it known that your research was authorised.
13. Europe and the United Kingdom
If a personal data breach affects account data, we will notify the competent data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. If it is likely to result in a high risk, we will also tell the people affected without undue delay. This follows the GDPR, the UK GDPR and, for Switzerland, the Federal Act on Data Protection.
If a breach affects the customer data you put into WhizInvoice, we will notify you without undue delay and within 72 hours of becoming aware of it, so you can meet your own duties, as our Data Processing Addendum sets out.
14. United States
Every US state has a data breach notification law. If a breach affects your personal information, we will notify you, and any authorities those laws require, within the time they set. If a breach affects customer data, we will notify you within 72 hours of becoming aware of it so you can meet your own duties.
15. Canada
If a breach of security safeguards creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify the people affected, as PIPEDA requires. In Quebec, we will report a confidentiality incident that presents a risk of serious injury to the Commission d’accès à l’information and notify the people affected. We keep a record of every breach.
16. Australia and New Zealand
In Australia, if a data breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and the people affected under the Notifiable Data Breaches scheme. In New Zealand, if a privacy breach has caused or is likely to cause serious harm, we will notify the Privacy Commissioner and the people affected as soon as practicable.
17. Everywhere else
Wherever you are, if a breach affects your personal data, we will tell you and the authorities as your local law requires. If it affects customer data, we will notify you within 72 hours of becoming aware of it.
18. Contact
Security questions and reports: security@whizinvoice.com. Everything else: support@whizinvoice.com.