Security Policy

1. Our Commitment to Security

At Invoverge, security is a top priority. We understand that you entrust us with sensitive business and financial data, and we are committed to protecting it with industry-leading security practices.

2. Infrastructure Security

Cloud Infrastructure

• Hosted on managed Kubernetes infrastructure operated by a certified cloud provider (see §10 for third-party certifications). Invoverge itself is not currently SOC 2 certified — certification is on our roadmap.
• Multi-zone deployment for redundancy
• Automatic failover at the infrastructure level

Network Security

• Cloudflare Web Application Firewall (WAF)
• Cloudflare DDoS mitigation (Layer 3/4/7)
• Rate limiting at the application and edge layers
• Strict Content-Security-Policy, X-Frame-Options: DENY, HSTS

3. Data Encryption

In Transit

• TLS 1.2 or higher for all connections (Cloudflare edge negotiates 1.2 & 1.3)
• HSTS (HTTP Strict Transport Security) enabled
• Cookies flagged Secure, HttpOnly, SameSite

At Rest

• Passwords hashed with bcrypt (cost 12)
• Tenant BYO Stripe / PayPal credentials encrypted with Fernet (AES-128-CBC + HMAC-SHA256) using a server-side master key held in environment variables
• Underlying storage volumes encrypted at the disk layer by the cloud provider (AES-256, provider-managed)
• Encryption master key is never stored in the code base, git history, or database

4. Application Security

• Dependency updates applied on a regular cadence (Dependabot / manual review)
• OWASP Top 10 defensive controls (see items below)
• Content Security Policy (CSP) headers
• Cross-Site Scripting (XSS) mitigation: React auto-escaping + strict CSP
• NoSQL query safety: MongoDB queries built via the Motor driver with parameterized filters (no string concatenation)
• CSRF token validation on every state-changing request
• Automated regression suite covering multi-tenant isolation, auth, and payment flows

5. Authentication & Access Control

• Secure password hashing (bcrypt)
• Two-Factor Authentication (2FA) support
• httpOnly cookie session management with secure tokens
• Rate limiting on authentication endpoints
• Account lockout after failed attempts
• Role-based access control (RBAC)
• Audit logging of access events

6. Data Protection

• Strict multi-tenant data isolation: every database query is scoped by the authenticated user’s ID (verified by an automated regression suite)
• Daily automated MongoDB backups (02:30 UTC) with a rolling 7-day retention
• Data retention policies aligned with Canadian tax law (Income Tax Act s. 230) and Quebec Law 25
• Cascading deletion of user-owned collections upon account closure (see Privacy Policy §9)

7. Monitoring & Incident Response

Monitoring

• Sentry error monitoring (backend & frontend) with PII scrubbing
• Structured application logs
• Automated alerting on repeated failed logins (account lockout after 10 attempts)

Incident Response

• Internal Breach Response Runbook aligned with PIPEDA §10.1, Quebec Law 25 §63.7-63.12, and California Civil Code §1798.82
• Notification to affected users and, where required, to the Office of the Privacy Commissioner of Canada / Commission d’accès à l’information / Attorney General as applicable
• Target notification timeline: 72 hours from confirmation of a real risk of significant harm
• Post-incident review within 14 days

8. Personnel & Access Control

• Principle of least-privilege for all production access
• Confidentiality obligations bind everyone with production access
• Production credentials rotated on personnel changes
• Multi-factor authentication required for administrative access

9. Third-Party Security

• Vendor security assessments
• Data processing agreements with all sub-processors
• Regular review of third-party access
• Use of certified payment processors (PCI DSS compliant)

10. Compliance

Our security practices align with the following frameworks. Where a certification is held by a sub-processor rather than Invoverge directly, we say so explicitly.

• PIPEDA (Canada federal) — direct compliance
• Quebec Law 25 — direct compliance
• CCPA / CPRA (California) — direct compliance
• CASL (Canadian anti-spam) — direct compliance
• CAN-SPAM Act (US) — direct compliance
• GDPR — technical controls in place; DPA available on request
• PCI-DSS — SAQ-A applicable (Invoverge never stores card data; Stripe / PayPal handle cardholder data on their PCI-DSS Level 1 certified infrastructure)
• SOC 2 Type II — infrastructure provider only; Invoverge itself is not currently SOC 2 certified

11. Security Updates

We continuously improve our security posture. Security patches are applied promptly, and we regularly update our practices to address emerging threats.

12. Reporting Security Issues

If you discover a security vulnerability, please report it responsibly to:

13. Contact