How Invoa protects your invoices, payments and data.

Where your data lives

• Servers, database and files run on Google Cloud in the Singapore region, on infrastructure operated by Prigo X Technologies Sdn. Bhd.
• Data is encrypted in transit (TLS 1.2 or higher, HSTS) and at rest on Google Cloud's encrypted disks.
• Secrets such as database credentials and payment-provider keys are held in Google Secret Manager, never in code or in the repository.
• The database is not reachable from the internet; only the application and the worker on the same machine can connect.

Signing in

• Passwords are stored only as salted hashes; Invoa cannot read them. Minimum eight characters.
• Sign in with Google is available, using Google's own sign-in with no password stored by Invoa.
• Two-factor authentication with an authenticator app and backup codes can be turned on by any user in Settings → Account; owners and admins are asked to.
• Changing your password signs out every other device. Sessions expire and are renewed in the background.

Inside the app

• Every company is isolated: every query carries the company's identity, and a user only sees the companies they belong to, in the role they were given (owner, admin, member, accountant, viewer).
• Issued documents are immutable. Corrections are new documents (a revision, a credit note or a void), never silent edits; the original snapshot is kept.
• Every change is written to the company's audit log with who, when and from where. Every call an AI assistant makes is logged with its outcome.
• AI assistants connect through OAuth with the permissions you approve. Issuing a document, sending it, submitting to LHDN and voiding always wait for your approval inside Invoa.
• API keys are hashed, scoped to a company and rate-limited.

Payments and e-invoicing

• Online payments go through CHIP straight to your own CHIP merchant account. Invoa never holds your money and never sees card numbers.
• e-Invoices are signed and submitted to LHDN MyInvois by Prigo X Technologies as your appointed intermediary; the raw request and LHDN's response are kept with each submission.
• Identity card and passport numbers are never sent to connected AI assistants.

Backups and continuity

• A full database dump every night, kept for seven days, and disk snapshots twice a day, kept for fourteen.
• Restores are drilled monthly and after any database change: the newest backup is loaded into a scratch database and its contents checked.
• Deployments build in Google Cloud Build with a dependency audit; a critical advisory in a production dependency stops the deployment.
• You can export everything you own, documents and PDFs included, from Settings → Data export at any time.

People and process

• Access to production is limited to Prigo X staff who operate the service, with their own accounts; actions taken by Invoa staff on your company appear in your audit log as "Invoa admin".
• We process personal data under Malaysia's Personal Data Protection Act 2010; the details are in our privacy policy.
• We are not yet certified against ISO 27001 or SOC 2. We say so plainly rather than imply otherwise.

Reporting a problem

If you believe you have found a security issue in Invoa, email hello@invoa.io with the subject "Security report" and what you saw and how to reproduce it. We acknowledge reports within two working days, fix confirmed issues before discussing them publicly, and credit reporters who want it. Please do not access other customers' data while testing.

Related: Privacy policy · Terms · About Prigo X