Security

Money

Invoices, payments and the ledger are written only by server functions. Staff edits are limited to cosmetic fields and refused once an invoice is paid.

Card data

The pay page is a separate origin with a strict content-security policy and no analytics. A card number exists only as a local variable inside the charging function; we store the last four digits and the card type.

Gateway credentials

Encrypted per business with AES-256-GCM under a key that never leaves our secret store; a second settings password gates every change; live activation needs a passed self-test.

Customers

A customer reaches a bill only through a contact a business verified. The portal has no passwords: an emailed link or a texted code proves the contact each time.

Your team

Roles, invitations bound to a verified email, recent sign-in for sensitive actions and, when you turn the policy on, a second factor before live payments, API keys and app connections.

AI

Models run server-side and emit schema-validated data — never markup, styles or scripts. Templates and themes are drafts until a person publishes them.

Assistants

Connected apps hold scoped credentials with a ceiling: an assistant can read, draft and propose, and a human approves anything that sends or charges.

Found something? Write to security@billingmart.com. An independent security review is part of the launch plan.