Security at IMW Invoice
Last updated: May 31, 2026
Your invoices, customers, and payment records are some of the most sensitive data your business has. Protecting them is foundational to IMW Invoice. This page explains the measures we take to keep your data safe.
Encryption in transit
All traffic between your browser and the Service is encrypted with TLS (HTTPS). Your data is never sent over an unencrypted connection.
Isolated databases
Each company’s data lives in its own dedicated database, not mixed into shared tables with other customers. This separation is a core part of how the platform is built, and it limits the blast radius of any single issue.
Daily backups
We back your account up every day so your history can be restored if something goes wrong. Backups are part of the hosted service, with nothing for you to configure.
Hosting and infrastructure
We run the Service on servers we manage and keep patched. Because IMW Invoice is fully hosted, there is nothing for you to install, update, or maintain, and security updates are applied for you.
Payment security
Card and ACH payments are handled by established, PCI-compliant payment processors (Authorize.Net, Stripe, and PayPal). Sensitive payment details are processed by those providers, and we do not store payment information on our servers.
Access controls
Passwords are stored hashed, never in plain text. Access to production systems is limited to authorized personnel who need it to operate and support the Service.
Your role in security
Security is a shared responsibility. We recommend you:
- use a strong, unique password for your account;
- keep your login credentials private and never share them;
- sign out when using a shared or public device;
- contact us right away if you suspect any unauthorized access.
Reporting a vulnerability
We welcome reports from security researchers. If you believe you have found a vulnerability, please email us at [email protected] with the details and steps to reproduce. We investigate every good-faith report, and we will not pursue legal action against researchers who act in good faith and avoid privacy violations or service disruption.
Questions
For any security question, reach us at [email protected] and a real person on our team will reply.