Security and data protection

1. Your account

• Passwords are stored only as salted bcrypt hashes.
• When you sign in with Google or Apple, our server verifies the sign-in with Google or Apple before trusting it. We never receive your Google or Apple password.
• The phone apps keep your sign-in token in the device's secure storage — the Keychain on iPhone and iPad, the Keystore on Android. In a web browser it is kept in that browser's storage for app.payverly.app. Signing out removes it from that device.
• Password-reset codes expire after 10 minutes, work once, and stop working after repeated wrong guesses. A reset request doesn't reveal whether an email address has an account.
• Sign-in, sign-up, password reset and email sending are rate-limited against brute-force attempts and abuse.

2. Your business data

• Your invoices, receipts, clients, catalog and business profile are stored on our servers, so they are the same on every device signed in to your account.
• Every request for your data is checked against your signed-in session on the server — not just hidden in the app.
• We do not sell your data or share it with data brokers. The service providers that make specific features work, and what each receives, are listed in the Privacy Policy.
• Details you store about your clients are processed on your behalf, only to provide the app to you. See data about your clients.

3. Mail-server passwords

If you email invoices from your own address, your mail-server password is encrypted with AES-256-GCM before it is stored, using a key held outside the database. It is never sent back to the app, never shown in our admin tools, never written to logs, and used only to send the messages you ask us to send. You can remove it at any time from Settings → Email sending.

4. Payments

Payverly records payments you have received; it does not move money. There are no card numbers or bank logins in Payverly to protect, because Payverly never asks for them.

5. Ads, analytics and this website

• Ads and product analytics run only in the iPhone, iPad and Android apps. The app never asks to track you across other companies' apps and websites.
• Analytics record which screens and features are used — never your invoice contents, client details or business figures.
• This website sets no cookies, runs no analytics or third-party trackers, loads its fonts from our own server, and is served over HTTPS only with a strict Content Security Policy.

6. Deleting your data

Deleting your account erases your account, business profile, invoices, receipts, clients, catalog and support tickets, and stops push notifications. We keep only a minimal record that the deletion happened — no name, email address or password. Routine backups and server logs age out on their normal cycle. How to delete your account.

If we ever discover a breach affecting your data, we will notify you and the relevant authorities as required by law.

7. Report a security issue

If you believe you have found a security vulnerability in Payverly, Payvora, app.payverly.app or this website, please tell us privately first.

• Email privacy@payverly.app with the subject “Security report”.
• Describe the issue, the steps to reproduce it, and the affected URL or app version. Screenshots or a short video help.
• Test only against accounts you own. Don't access, change or delete other people's data, and stop as soon as you have shown the problem.
• Please don't run denial-of-service or spam tests, or try social engineering or physical attacks.
• Give us a reasonable chance to fix the issue before you share it publicly.

We will confirm that we received your report and keep you updated while we work on it. Our contact details for researchers are also published at /.well-known/security.txt.