Security
Your business data deserves to be protected.
PayFlowAI handles sensitive financial and customer information. Security is built into how we manage access, protect data, and operate our platform—so you can focus on getting paid. Here's exactly how, written plainly, with no security theatre.
A note on where we are. PayFlowAI is an early-stage product. We've built our security foundations in from day one, the controls below are live in the product now. We're transparent about what we haven't formalized yet, too: see our planned improvements further down.
Built for the financial information you work with every day.
Invoices contain more than amounts and due dates. They can include customer details, commercial terms, and records of payments received.
PayFlowAI is designed to help you manage this information with appropriate access controls, protected connections, and clear options for accessing your data.
Your records
Manage invoices and client information in one place.
Controlled access
Authentication and authorization help protect your account and its data.
Your information
Export supported records when you need them.
In place today
Our security controls
Encryption at rest
Sensitive data is encrypted in storage using AES-256-GCM. Encryption includes integrity protection to help prevent stored data from being read or altered without authorization.
Encrypted connections
Connections to PayFlowAI are protected by HTTPS/TLS, helping safeguard information as it travels between your browser and our services.
Account-level data access
Access to application data is controlled through authenticated sessions and server-side authorization. Your invoices and client records are scoped to your account to help prevent unauthorized access.
Secure payment processing
Subscription billing and payment processing are handled through Stripe. Card details entered through Stripe’s secure checkout are handled by Stripe rather than stored directly by PayFlowAI.
AI with a clear purpose
PayFlowAI uses AI to help with invoicing, payment follow-ups, and financial insights. Information is shared with AI providers when needed to generate requested results, subject to the applicable provider terms and data-handling arrangements.
European hosting and data protection
PayFlowAI uses European data hosting for the services covered by its hosting arrangements and is designed to support GDPR-related data protection requirements. We do not sell or rent your personal data.
Protected account access
Email verification, supported sign-in options, and anti-abuse safeguards help protect accounts and reduce automated misuse.
Managed, maintained infrastructure
PayFlowAI runs on managed infrastructure provided by established technology platforms, including Supabase and Vercel. This reduces the need to operate underlying servers ourselves and allows us to benefit from the providers’ infrastructure and maintenance capabilities.
Your data stays accessible
Export your invoices and client information in the supported formats whenever you need them. You can access your records without relying exclusively on the PayFlowAI interface.
Independent security rating
Independently assessed. Continuously monitored.
SecurityScorecard provides an independent view of our external security posture. Explore our current rating and review the available assessment details directly.
Sub-processors
Who we trust with your data
We work with a small set of established providers, each chosen for their security posture.
Supabase
Database, authentication, and file storage
Stripe
Subscription billing and payment processing
Anthropic (Claude)
AI command bar, reminders, and insights
Vercel
Application hosting and delivery
This list reflects our current setup and may change as we grow. We'll keep it up to date here. For how we handle personal data, see our Privacy Policy.
Ongoing improvement
Our ongoing security commitments
Security is an ongoing process. We continue to strengthen our controls as PayFlowAI grows, with a focus on independent assurance, security testing, and stronger account protection. We'd rather be honest about what isn't formalized yet than imply certifications we don't hold.
Independent security assurance
We intend to pursue a formal SOC 2 Type II examination as the platform and our operational processes mature.
Independent penetration testing
We plan to commission independent penetration testing to help identify and address vulnerabilities as the product evolves.
Stronger account security
We plan to expand account protection with additional authentication options, including two-factor authentication and team-oriented single sign-on.
Found a potential security vulnerability?
If you've identified a potential security issue in PayFlowAI, please let us know. Share the relevant details through our contact form, choosing “Security issue” as the topic, so we can investigate and address the issue appropriately.
See how PayFlowAI helps you create invoices, track payments and handle follow-ups.
Explore PayFlowAI features