Security

Connections

• Every page and request uses HTTPS. HTTP Strict Transport Security tells browsers never to connect without it.
• A Content Security Policy limits where scripts can be loaded from: our own site, Cashfree’s checkout, and Google Analytics only after you accept it.
• Our pages cannot be framed by other sites, and browsers are told not to guess file types or send full page addresses to other sites.

Signing in

• Passwords are hashed with scrypt and a unique salt. We never store or see them in plain text.
• Two-step sign-in sends a one-time code to your email. Codes are stored hashed and expire within minutes.
• Sessions live in secure, http-only cookies that page scripts cannot read. We store only a hash of each session token, and a session ends after 30 days without use.
• Each person has a device limit, and we email you when a new device signs in.
• Sign-in, code and other sensitive requests are rate limited to slow down guessing and abuse.

Your records

• Every database query is scoped to the business it belongs to; the system is designed so that one business cannot read another’s records.
• Payment proof files are stored outside the public web folder and shown only to signed-in members of the business that uploaded them and, where the business shares a file with a customer, to that customer after they enter their one-time code.
• Shared invoice links use long random tokens and are hidden from search engines.
• A customer’s page (their invoices, statements, payments and messages) opens only with a one-time code emailed to the address the business has for that customer. The code works for 10 minutes and is burned after five wrong tries.
• We never receive card numbers, UPI PINs or bank log-ins. Payments are handled by Cashfree in India and PayPal in other countries.

Operations

• Our server and database are hosted on Google Cloud in Mumbai, India. Encrypted backups are kept in Google Cloud Storage in the United States. Cloudflare sits in front of the site to deliver pages and filter attacks.
• The database and uploaded files are backed up every night to a private storage bucket in the same region, and backups are kept for 30 days.
• Openn Invoice runs in a Google Cloud account. On our side, only the founder has the sign-in to that account, the server and the database. Google’s staff can reach the machines as our hosting provider, under Google Cloud’s terms. Our operator console runs on a separate address with its own sign-in and emailed codes. Anyone given access to it has their own sign-in, a role that limits what they see, and a duty of confidentiality, and what they do there is written to an audit log.
• Sensitive account changes are written to an audit log.

If a breach affects your data, we tell you as our privacy policy and data processing addendum set out.

Report a vulnerability

If you find a security problem, email hello@theopenngroup.com with the steps to reproduce it. We will confirm receipt, keep you updated, and fix confirmed issues as fast as we can. Please give us reasonable time to fix it before telling anyone else.

While testing, only use your own account, don’t access or change other people’s data, and don’t run tests that slow down or disrupt the service. We will not take legal action against research done in good faith within these rules.