Trust center
Invoice Crowd protects business records through authenticated sessions, CSRF checks, optional TOTP two-factor authentication, role and capability gates, active-business scoping and provider-side payment verification. This page also states the limits that still matter to a buyer's review.
Last updated:
Current controls
The application uses several narrow boundaries rather than treating a visible page or browser response as proof of authority.
Identity checks start before a business record is loaded.
The owner application uses Laravel session authentication and CSRF protection. New passwords require upper- and lowercase letters, a number and a special character, and account security settings support time-based one-time-password two-factor authentication.
Signup uses CAPTCHA and layered address/IP throttles. Login applies account and IP limits and can require an adaptive CAPTCHA after repeated failures.
An authenticated user still needs the right owner, business and capability context.
Application operations resolve the owner or team parent and the selected business profile. Team-visible modules and sensitive actions pass permission or named-capability checks, with unknown team modules denied by default.
The mature application does not use one universal database-level tenant scope. Controllers, services and queries must preserve the owner and active-business invariant, so security review and regression tests remain part of every sensitive change.
A browser return or posted status is never enough evidence of payment.
Supported active gateways verify a signature and/or perform an authenticated provider read, then compare the tenant, gateway account, allocation, amount, currency and successful state before settling an invoice.
The application includes a scheduled daily database-backup command and production preflight processes. A schedule is not a recovery guarantee by itself: monitoring, retention, restore testing and production configuration still need operational verification.
Evidence and boundaries
Current controls, operational dependencies and explicit non-claims, based on the application and architecture reviewed August 7, 2026.
Laravel session authentication with CSRF protection for the owner application.
Optional TOTP setup, confirmation and disable paths in account security settings.
CAPTCHA, account/address limits and source-IP throttles are applied at the server boundary.
Module rules and named capabilities restrict team-visible and sensitive operations.
Records are resolved within the owner or team parent and selected business profile.
Active flows require provider evidence and exact commercial binding before settlement.
Application upload paths validate allowed type, extension and content at their owning boundary.
The server-side assistant is tool-limited, tenant-scoped and stages writes for confirmation.
A daily database-backup task exists; production monitoring and restore readiness are separate operational evidence.
Some protected credentials use dedicated encryption, but no blanket claim is made for every legacy setting.
This site does not claim SOC 2, ISO 27001, HIPAA or another independent certification without evidence.
Report a suspected security issue privately through the support contact rather than posting account data publicly.
Questions
Yes. Account security settings include optional TOTP two-factor authentication for an authenticator app, with setup, confirmation and disable flows protected by the signed-in session and throttling.
Application operations resolve the owner or team parent and the active business profile before accessing business records. Team roles and named capabilities further restrict modules and sensitive actions.
No. Active payment paths require provider-side evidence, such as a verified signature or authenticated provider read, and compare the account, allocation, amount, currency and successful state before settlement.
Invoice Crowd integrates with external payment providers for configured checkout and payment methods. This page does not make a blanket PCI-scope or zero-card-data claim; the exact data path depends on the provider integration and should be reviewed for the gateways you enable.
No such certification is claimed on this page. Ask Invoice Crowd for current written evidence if a procurement process requires an independent certification, penetration test or data-processing document.
The application schedules a daily database-backup task, but a schedule alone does not prove production completion, retention or restore readiness. Those operational controls should be verified for the live environment and your recovery requirements.
Review the product, ask for the evidence your organization requires, and start with a limited account and representative data before wider rollout.
