Security & trust

Security is enforced at separate boundaries.

Identity, tenant authorization, invoice data, provider secrets, and evidence use separate fail-closed controls.

HttpOnlySameSite=StrictRLSencrypted artefacts

Trust boundary map

fail-closed

Identity & tenant

identity · membership · RLS

Invoice data

encryption · retention · purge

Evidence

bounded output · no payload

Request-supplied tenant or role values do not create authority.

Enforced controls

Each control stays independently inspectable.

Controls are not collapsed into one blanket claim: identity, isolation, encryption, retention, secrets, and evidence remain independently inspectable.

Identity & authority

Who can act, in which tenant, and with what authority.

Tenant-scoped authority

Verified identity + active membership + RLS; request tenant/role values grant no authority.

Browser sessions

Secure, HttpOnly, SameSite=Strict server session with bounded CSRF authority.

Team invitations

Short-lived, single-use invites; an invite never grants owner authority.

Data lifecycle

How invoice bytes are encrypted, retained, and purged.

Encrypted invoice artefacts

Invoice bytes encrypted outside PostgreSQL and excluded from logs and share-safe evidence.

Retention and purge

Encrypted retention capped at one hour; purge state remains auditable.

Secrets & evidence

What stays isolated and what may leave as evidence.

Credential isolation

Provider secrets use separate encrypted custody; plaintext secrets stay out of evidence.

Evidence and data requests

Evidence excludes payloads; export/deletion requests remain subject to retention controls.

Trust & data reference

Privacy, rights, and trust — with their current limits.

Each reference separates what is actually enforced from what is unpublished or must not be read as a certification claim.

Privacy & data handling overviewDataTechnical data-handling boundaries — not a complete GDPR privacy notice.

Hosted access is tenant-scoped.

Provider credentials stay outside public metadata.

Share-safe evidence uses bounded identifiers and hashes.

Full note

This product page describes implemented technical data-handling boundaries only; it is not presented as a complete GDPR privacy notice. InvoiceRig minimizes public exposure of personal data and protected invoice content: hosted access is tenant-scoped, provider credentials stay outside public metadata, and share-safe evidence uses bounded technical identifiers and hashes. No operator, controller, retention-period, data-subject contact, or statutory disclosure is invented on this public surface when that authority is not defined in the repository.

Data rights, deletion & supportRightsRequests can be recorded in-product; support@invoicerig.com is the verified response channel and fulfillment remains server-side.

Organization admins can record export requests.

Owners can record deletion requests.

Recording a request does not itself export, purge, archive, or delete data.

Full note

InvoiceRig's implemented customer-data controls are tenant-scoped and deletion must be enforced server-side through the retention and purge boundary rather than by hiding data in the browser. Authenticated organization admins can record export requests and owners can record deletion requests in hosted Settings; these records do not themselves export, purge, archive, or delete data. support@invoicerig.com is the verified response destination for privacy, security and data-rights requests. The public surface still does not invent unverified statutory controller identity or registered-address details.

Security & trust controlsTrustImplemented controls only — no certification claim and no trust inferred from sandbox behavior.

Tenant access is membership-validated and runtime database roles do not bypass RLS.

Logs, evidence, recovery bundles, and provider credentials have separate boundaries.

Real customer invoice upload uses the reviewed encrypted production path with managed custody, bounded retention and auditable purge controls.

Full note

Implemented controls include membership-validated tenant access, non-BYPASSRLS runtime database roles, bounded logs and evidence, encrypted recovery bundles, and isolated credential custody. Real customer invoice upload uses the reviewed production path with encrypted object storage, managed key custody, bounded retention and auditable purge controls; provider execution derives tenant authority from live job leases and this page does not convert sandbox behavior into a certification claim.