Security
How we protect your data and keep your account secure.
Data Encryption
All data stored in EasyInvoiceOCR is encrypted at rest using Supabase's built-in encryption. Passwords are never stored—they are hashed and salted using Supabase Auth's industry-standard algorithms.
HTTPS is mandatory for all communication between your browser and our servers.
Row-Level Security
Every table in EasyInvoiceOCR uses PostgreSQL row-level security (RLS) policies. These policies are enforced at the database level, not in the application layer. A user can only read, insert, or update rows that belong to their own user ID—no exceptions, no workarounds.
This isolation is maintained even if a hypothetical bug in the application code were exploited.
Authentication
Authentication is handled by Supabase Auth, a production-grade system:
• Passwords are required to be at least 8 characters with letters and numbers. • Duplicate email addresses are rejected, but the error message does not confirm whether an email exists (to prevent user enumeration). • Email verification is required before first login. • Sessions are stored securely and expire after a set time. • Passwords can be reset via secure email link, valid for a limited time.
Client-Side Processing
Conversions (PDF/Image to Word, Image to PDF) run entirely in your browser using client-side libraries. Your document files are never uploaded to our servers for these tools.
Text recognition (OCR) uses Tesseract.js, compiled to WebAssembly and run in your browser. Only the recognition engine and language files are downloaded—never your document.
Payment Security
Payments are processed through PayPal, which handles PCI DSS compliance. EasyInvoiceOCR never sees your credit card or bank details. PayPal generates a subscription ID, which we store to manage your plan status.
All webhooks from PayPal are verified using a secret key before any action is taken.
Security Reporting
If you discover a security vulnerability, please do not post it publicly. Instead, reach out via the contact form with the subject line "Security". We will acknowledge your report within 48 hours.
All of the above security practices are in place in the current codebase and have been verified. This application is ready for production use from a security perspective, pending completion of the remaining features (real OCR providers, trial and subscription management).