Security

Last updated: 2026-10-17

Hosting

Invoicia runs on a server at Hetzner in Germany. The application and the PostgreSQL database run on our own server there. Traffic to the site and API is served over HTTPS.

Sign-in and access

Sign-in is handled by FjordID (a self-hosted Keycloak) using OpenID Connect with PKCE. Invoicia never sees or stores your password.
Every API request is checked against the signed token FjordID issued (verified with its public keys). Invoices, customers and profiles are only returned to the account or team that owns them.
API keys for programmatic access are stored only as a SHA-256 hash and can be revoked.
The API sets standard security headers and rate-limits requests. The public file tools have tighter per-IP limits and a daily cap.

What we do not claim

We hold no security certifications (for example ISO 27001 or SOC 2).
We make no statement about encryption of data at rest. Data is encrypted in transit (TLS); we have not verified disk or database encryption at rest.
Some third-party services receive data. Which ones, and where they are based, is listed on the Subprocessors page, including the ones that are not EU-only or whose agreements are not verified.
Invoicia is run by a sole proprietor, not a security team. There is no 24/7 response.

Reporting a security issue

Email support@invoicia.eu with a description of the issue and steps to reproduce it. Please do not access other people's data, and give us reasonable time to fix the problem before you disclose it publicly. We will read every report and reply; we do not run a bug bounty.