Trust
Security Overview
MSP Billing uses credential isolation and narrowly scoped permissions. Reconciliation connections read invoice and billing data only; the Xero Billing Engine creates reviewable drafts only when you explicitly run it. We never send client invoices automatically or store your passwords.
Connections
How we connect to your tools
HaloPSA connects via an API key you generate yourself in your own HaloPSA instance. QuickBooks and Xero connect via OAuth 2.0, the same authorisation standard used by banks, where you approve access directly with the provider and we never see your password. Pax8 connects via OAuth 2.0 client credentials, using a client ID and secret generated in your Pax8 developer portal. Connections used for reconciliation are read-only and can be revoked by you at any time. The Xero connection creates draft invoices only when you explicitly run the Billing Engine; it never sends an invoice to a client automatically.
Credentials
How your credentials are stored
Your API keys and connection credentials are encrypted at rest using Fernet symmetric encryption, with a key derived using scrypt, a memory-hard key derivation function designed to make brute-force attacks computationally expensive even with specialised hardware. This means that even if someone obtained a copy of the database and the application code, they could not recover your credentials without the encryption key, which is stored separately from both. Each organisation's credentials are encrypted independently, so one customer's data is cryptographically isolated from another's. TOTP secrets used for two-factor authentication are also encrypted at rest using the same scheme.
Authentication
How you log in
Login is passwordless. You authenticate via a single-use magic link sent to your email address that expires in 15 minutes, eliminating the risk of password theft, credential stuffing, and brute force attacks. Multi-factor authentication is mandatory for all users, using TOTP, the same time-based code standard used by banks and enterprise software, compatible with Google Authenticator, Authy, and similar apps. We don't use SMS codes, which are vulnerable to SIM-swap attacks.
When you complete MFA, your session is valid for 30 days. If you lose access to your authenticator app, you can use one of eight one-time backup codes generated when you set up MFA. MFA cannot be disabled once set up.
Sessions
Sessions and access control
Sessions are stored server-side and can be revoked instantly, logging out invalidates your session immediately, not just in your browser. You can log out of all devices simultaneously from your account settings. Sessions expire after 30 days from creation regardless of activity. Invite links for new users expire after 48 hours.
Transit
How your data is secured in transit
All connections between your browser and MSP Billing use HTTPS with HSTS enabled, so browsers are instructed to never connect over an unencrypted connection, even on the first visit. Session cookies are marked HttpOnly and Secure, meaning they cannot be read by JavaScript or transmitted over an unencrypted connection.
Defences
Protection against common attacks
Login attempts are rate-limited to 5 per 15 minutes per email address. MFA code attempts are rate-limited to 5 per 5 minutes. All state-changing actions, including saving settings, connecting tools, and modifying rules, are protected against Cross-Site Request Forgery (CSRF), preventing malicious websites from performing actions on your behalf. HTTP security headers are set on every response, including frame protection to prevent clickjacking, content-type sniffing protection, and a strict Content Security Policy. Access to the platform is invite-only. There is no public self-signup.
Audit
Audit logging
All sensitive actions are recorded in a tamper-proof audit log, including connecting or disconnecting tools, creating or deleting reconciliation rules, inviting users, and enabling or resetting MFA. Each entry records who performed the action, when, and from which IP address. The audit log is visible to your organisation's users in Settings and is never purged.
Retention
Data retention
Snapshot and reconciliation data is automatically purged after 12 months. Audit logs, client mappings, connector credentials, and account configuration are kept indefinitely. You can request full deletion of your data at any time by contacting us.
Residency
Where your data lives
Your data is stored in a PostgreSQL database hosted on Supabase in Ireland, and the application runs on Railway in Amsterdam. Both are EU West regions. Your data never leaves Europe. Both providers are GDPR-compliant infrastructure platforms.
Scope
What data we actually hold
We store invoice line data, client names, quantities, amounts, and service descriptions, pulled from your connected tools. We use this to power reconciliation and month-on-month comparisons. We do not store payment details, bank information, or any data beyond what is needed to run the reconciliation.
Technical Security Details
For engineering teams and technically-minded partners: encryption algorithms, session mechanics, CSRF implementation, rate limits, and infrastructure specifics.
View details