Security
How we look after your account and invoices.
What is in place today, in plain words. Where something isn't done yet, we say so.
Last reviewed
Accounts
Signing in.
You sign in with your email address and a password.
- Passwords are hashed with bcrypt
- We store only a bcrypt hash of your password (cost factor 12), never the password itself, and we never email it to you.
- Sign-in doesn’t reveal who has an account
- The same password check runs whether or not the email address exists, so the sign-in form can’t be used to find out who is registered.
- Sessions are signed tokens
- After you sign in, NextAuth keeps your session in a signed JSON Web Token stored in an HTTP-only cookie, which scripts on the page can’t read.
- Attempts are limited
- Sign-in, sign-up, the contact form and invoice emails are rate limited to slow down guessing and abuse.
Your data
Your invoices are yours alone.
Access rules are enforced on the server, not just hidden in the interface.
- Every request is checked
- Every API route checks your session first and only reads or changes records that belong to your account. Another user can’t see your invoices, clients, company details or token history.
- Responses carry only what’s needed
- Invoice data sent to your browser includes your email and company details, never your password hash or other account fields.
- Issued invoices are locked
- Only drafts can be edited. Once an invoice is issued its client, lines and dates are fixed and only its status can change, so a paid invoice can’t be rewritten and sent again as another one.
- PDFs only for issued invoices
- PDFs, emails and share links work only for issued invoices, never drafts. A PDF is made from a print page that opens only with a signed link valid for five minutes.
- Share links
- A share link uses the invoice’s long random ID. Anyone who has the link can view that invoice, so send it only to your client.
The website
What your browser is told.
- A strict Content-Security-Policy
- Each page is sent with a new random nonce, and the browser runs only scripts that carry it. A script slipped into a page, for example through a form field, won’t run. Pages can only connect back to this site, and other sites can’t show our pages in a frame.
- Other headers
- We also send nosniff, a strict referrer policy and a permissions policy that turns off the camera, microphone and location.
- Emails are escaped
- Company and client names are escaped before they go into an email, so they can’t inject links or markup.
Other services
Who else handles your data.
A few services do specific jobs for us. They only get what that job needs.
- Resend
- Sends email: invoices you email to clients, contact form messages and status updates.
- Browserless
- Turns an issued invoice into a PDF from our print page.
- Payments
- No payment provider is connected at the moment, so we don't take card payments online.
How we use personal data is set out in the privacy policy.
Not yet
What we haven’t done.
So you can judge for yourself.
- An independent penetration test.
- A certification such as SOC 2 or ISO 27001.
- Two-factor sign-in.
- Email address verification at sign-up.
Rate limits are kept in memory on each server, so they are a first line of defence rather than a guarantee.
Report a problem
Found a vulnerability?
Thank you. Please tell us privately first.
Email info@paperstub.com with what you found, the steps to reproduce it and what an attacker could do with it. Please don't access other people's data, and give us reasonable time to fix the problem before you make it public.
We don't run a paid bug bounty.
Data protection
Who is responsible.
- Data controller
- VIARGAMING LTD
- Company number
- 15847699
- Registered address
- 43 Victoria Rd, Northampton, United Kingdom, NN1 5ED