We describe the controls that exist today, and we don’t claim certifications we don’t hold.
Structured seller, buyer and line-item data.
FBR validation must return valid before posting.
The returned FBR invoice number is stored.
Posted invoices cannot be edited.
Creation and edits have recorded audit history.
Accounts are provisioned by an admin. Passwords are hashed with bcrypt using 12 rounds. One-hour access tokens with refresh tokens and rate-limited login govern access.
What this means for youYour account is provisioned through onboarding, with authenticated API access.
Invoice and profile queries are scoped to the owning account. Admins see the users they onboarded. Super Admins can see the platform.
What this means for youAccount ownership and administrator roles determine which records are visible.
Every invoice is validated before posting. Posting is blocked while in progress or once an FBR invoice number exists. Posted invoices are locked, and money uses exact decimals.
What this means for youThe saved invoice and its FBR acknowledgement remain linked after posting.
The audit log records who changed what, when and from where, with before and after values. It covers invoice creation, updates and deletion, user and admin changes, and logins.
What this means for youYou can review recorded changes rather than reconstructing them from memory.
API inputs are sanitised and validated. Security headers and API rate limits form additional application controls.
What this means for youRequests are checked at the API boundary as well as in the interface.
Invoice records use PostgreSQL on managed cloud infrastructure. Monetary values are stored as decimals with two decimal places; quantities use three.
What this means for youRecorded money and quantities retain their defined storage precision.
Application controls work alongside the decisions your team makes about access and invoice data. Your team manages these parts of the workflow.
Describe the affected page, the steps to reproduce and the impact you observed. Email us with the subject “Security report”.
Report a vulnerabilityStructured seller, buyer and line-item data.
FBR validation must return valid before posting.
The returned FBR invoice number is stored.
Posted invoices cannot be edited.
Creation and edits have recorded audit history.
Book a demo to discuss your sectors, scenarios and setup.