Invoice Bridge security overview

Current application controls

• Each store/company pair has separate encrypted connections and ledger files.
• Retained event bodies and privacy exports are encrypted in the shared registry.
• The server checks signed platform identities, current membership, admin rights, and applicable deal ownership.
• Team authorization does not replace the company service connection.
• Company policy, setup, billing, privacy, and recovery require the appropriate verified administrator or store owner.
• Approvals cover the exact reviewed draft and recipient; preparers cannot approve their own request.
• Signed webhooks and durable source references help prevent unauthorized or duplicate processing.
• Certificate links expire after 60 seconds and one use; privacy exports expire after 24 hours.
• App-managed ledger backups are encrypted, with a configured 14-day retention period. Affected app-managed backups are removed during erasure.
• App access audit records expire after 90 days. The records include an internal staff or system identity, workspace, operation, time, and result. They exclude buyer data, download links, and credentials.
• Resolved buyer details are eligible for cleanup after 90 days. Unverified closure and pending or reopened work hold cleanup. The 90-day scheduler and close-to-reopen updates have been tested in the development stores.
• The app uses memory-backed working ledgers and removes them after processing. Authorized operators may access the host when required for maintenance or incident response.

Merchant responsibilities

Protect platform accounts, assign suitable access, verify recipients and transactions, and keep source records and backups. Report suspected misuse to rob@fortylights.com. Do not send credentials, card details, or customer records through ordinary support email.

Recovery

We restore backups into an isolated environment and reapply completed deletion requests before resuming processing.