How we protect your books.
This page describes the security controls in place at SoftBillo today. It is maintained by MetaEdx Inc — the company that builds and operates SoftBillo, together with its UK subsidiary MetaEdx Technologies Ltd. It is not a third-party certification or audit report.
SoftBillo never holds your money
We are an invoicing, bookkeeping and micro project management app — not a bank, wallet, or payment processor. When your customers pay you, money flows directly from them into your own Stripe, PayPal, Wise or bank account through licensed partners. SoftBillo only records, categorises and reconciles that activity. We do not custody funds, and we do not advance or lend money.
How payment links work
When you send an invoice, we attach the payment link from your own Stripe, PayPal or Wise account (or your bank details). Your customer pays through that partner's hosted checkout — SoftBillo is never in the money flow.
- 1You connect an accountYou link your own Stripe / PayPal / Wise account, or paste bank details into the invoice.
- 2Your customer pays the partnerThey open the invoice, click the payment link, and complete checkout on Stripe / PayPal / Wise. Card data is entered on the partner's page — never on SoftBillo.
- 3Funds land in your accountThe partner settles directly to your own bank account on their normal schedule. SoftBillo has no access to that balance and never holds or moves your money.
- 4We record what happenedWe read the payment status (via webhook or upload of a bank alert) and mark the invoice paid so your books stay in sync.
- • Invoice details (line items, totals, currency, due date)
- • The payment link URL you configured
- • Payment status: paid / partial / outstanding
- • Amount received, date received, partner reference
- • Uploaded receipts or bank alerts you attach as proof
- • Your customer's card number, CVV, or bank credentials
- • Your Stripe / PayPal / Wise account balance
- • The funds themselves — money never routes through SoftBillo
- • Payout scheduling or withdrawals from your partner account
- • Refund settlement (initiated in your partner dashboard)
Card and bank data are handled entirely by the payment partner under their own PCI-DSS and licensing scope. SoftBillo stores only metadata about the transaction so you can reconcile your books.
Account & authentication
Sign-in is handled by an industry-standard managed auth provider. Passwords are never stored in plaintext — they're hashed before they ever touch a database. Google OAuth is available, email verification is mandatory on signup, and app-based two-factor authentication (TOTP) can be enabled from Settings → Security.
Roles & least privilege
Every workspace has owner, admin and member roles. Sensitive actions — billing, team changes, notification and workspace settings — are restricted to owners and admins, and the rules are enforced by database policies rather than hidden UI.
Security audit logging
Role changes, invitations, removals and notification-preference changes are written to a durable, server-side audit trail you can review from Settings → Security. Workspace owners can see who changed what, and when.
File upload safety
Receipts, logos and documents are validated by magic-byte inspection (not just the file extension), size-limited, and stored in a private object store where access is scoped to your workspace only.
AI (Vio) data handling
Vio only reads data inside your own workspace, and prompts and outputs are not used to train third-party models. AI output is assistive: it should be reviewed by a human before you rely on it for financial, tax or legal decisions.
Encryption in transit
Every request to softbillo.com and our APIs is served over HTTPS (TLS 1.2+). We do not accept plain-HTTP traffic for app routes.
Encryption at rest
Your data lives in a managed Postgres database with encryption at rest provided by the underlying cloud platform. Receipt files and logos sit in a managed object store with the same posture.
Workspace isolation
Every row in our database is protected by row-level security. A signed-in user can only read and write rows that belong to their own workspace — the database enforces this, not the application code.
Backups & availability
Our managed database provider takes automated daily backups. We do not commit to a specific RPO/RTO publicly today — if you need contractual guarantees, get in touch and we'll talk.
Responsible disclosure
Found a security issue? Please email us before sharing it publicly. We read every report personally and aim to acknowledge within two business days.
What we don't claim
We do not currently hold SOC 2, ISO 27001, PCI-DSS, GDPR, or HIPAA certifications. If your procurement team needs any of these, please reach out so we can have an honest conversation about timelines and scope.
Security FAQ
The questions we get most often from customers, buyers and security teams.
Report a vulnerability
Email info@softbillo.com with a description, reproduction steps, and any impact analysis. Please don't publicly disclose until we've had a chance to respond.
Not a security report? Use our contact page instead.
Last reviewed 7 August 2026 · Maintained by MetaEdx Inc and MetaEdx Technologies Ltd. See also our Privacy Policy and Terms of Service.