Security, explained plainly
You trust PayNudge with your invoices and your clients' contact details. Here is how we look after them, written without buzzwords and without claiming certifications we don't have.
Encryption in transit
The whole site and app are served over HTTPS with certificates renewed automatically. Connections to our AI, email and payment providers are encrypted too.
Data isolation per workspace
Every invoice, client, file and message belongs to exactly one workspace. Every query for your data is scoped to your workspace on the server, and access rights are checked on every request, never trusted from the browser.
Passwords and tokens
Passwords are hashed with a slow, salted algorithm and never stored in plain text. Email verification, password reset and invitation tokens are stored hashed and expire. Sign-in, sign-up and other sensitive actions are rate limited.
Where data lives
Your data is stored in a PostgreSQL database and a private file store on a virtual private server from our hosting provider. Protection of the physical disks at rest is handled by the provider's infrastructure. Uploaded invoices are only served to signed-in members of your workspace.
Backups
We take a full backup of the database and uploaded files every day. Backups are kept for 14 days and then deleted automatically.
Email you can trust
Reminders are delivered through Microsoft 365 (Exchange Online), not a home-grown mail server. Every send is logged in the app, so you can see exactly what went out and when.
AI and subprocessors
We use a short list of providers to run PayNudge: Anthropic for AI, Microsoft for email delivery, Polar for payments and our hosting provider. Anthropic does not train models on data sent through its commercial API.
Payments
Card details never touch our servers. Checkout and the billing portal are run by Polar.sh, our Merchant of Record, and its payment processors.
Your control over data
Account owners can delete their account and workspace at any time from Settings. Deletion is immediate in our live systems, and backup copies expire within 14 days.
Report a vulnerability
If you believe you've found a security issue, email support@paynudge.site with “Security report” in the subject, or use the contact form.
- Include steps to reproduce and the impact you expect.
- Only test against your own account and data.
- No denial-of-service, spam or social engineering, please.
- Give us reasonable time to fix the issue before sharing it.
We'll acknowledge your report, keep you updated, and credit you if you'd like. We don't pursue good-faith research.