Security and data handling

Authentication and account boundaries

Production authentication can use Clerk. Stored business records use owner identifiers and Supabase row-level security policies to separate account data. When those services are not configured, the application can operate in a browser-only demonstration mode that stores data in local storage on that device.

Stored business data

SendBilling may store business profiles, customers, invoices, estimates, products, transactions, schedules, and email settings. Users can export supported records and invoice documents. Review the privacy policy for purposes and retention information.

Email credentials

When custom SMTP is configured, the SMTP password is encrypted with AES-256-GCM before storage and is not returned to the browser. Deployment operators must configure and protect the server-side encryption key.

Invoice payments

SendBilling does not collect, process, hold, or reconcile invoice payments. An invoice can contain an external payment URL supplied by its sender. The customer leaves SendBilling to pay through that third party, whose security, fees, privacy policy, and terms apply. The sender updates the invoice status manually.

Public invoice links

Anyone who receives a valid public invoice link may be able to view the information shared at that URL. Treat the link as sensitive, share it only with the intended recipient, and avoid placing unnecessary personal information in invoices. These pages request exclusion from search indexing, but that does not replace careful link handling.

Current limitations

• No SOC 2, ISO 27001, PCI DSS, HIPAA, or similar certification is claimed on this page.
• SendBilling is not a payment processor and does not store card details for invoice payments.
• Browser-only demonstration data depends on the security and persistence of the local device.
• Users remain responsible for the accuracy and lawful handling of information entered into invoices and customer records.

Data in transit and service providers

Production deployments should use HTTPS so browser traffic is encrypted in transit. Authentication, database hosting, email delivery, application hosting, and SendBilling subscription billing may rely on service providers identified in the privacy policy. Each provider operates under its own security and availability practices.

Encryption in transit does not protect information after an authorized recipient downloads a PDF, forwards a public link, or exports a CSV. Users should apply their own access controls and retention practices to downloaded records.

User security responsibilities

• Protect the email account and authentication method used to access SendBilling.
• Review recipients before sending invoices or granting team access.
• Do not place card details, account passwords, government identifiers, or unnecessary sensitive data in invoice notes.
• Verify external payment URLs and bank instructions before sending them to customers.
• Remove access and rotate credentials when a team member or vendor relationship ends.

Reporting a security concern

Send a concise report to support@sendbilling.com with the affected URL or feature, reproduction steps, and potential impact. Do not include passwords, card information, customer data, or exploit details beyond what is necessary to identify the issue. No guaranteed response or remediation time is published.