Invoice MakerINVOICE MAKER · GLIPO YAZILIM
Invoice Maker Security & Data Controls
This page explains how the Invoice Maker web service is operated by Glipo Yazılım. For questions, contact destek@invoicemake.app .
Security model
Invoice Maker separates the public website, authenticated workspace and payment providers. Production traffic uses HTTPS. Authentication is handled through configured Firebase providers, while server routes verify identity before reading or changing a workspace. Subscription access is accepted only after server-side verification from Paddle or the configured mobile subscription provider.
Workspace and financial records
Application records are stored in PostgreSQL and scoped to a workspace. Update operations use revision and generation checks to reduce accidental overwrites. Finalized documents use void and revision flows; payment corrections use reversal entries so financial history remains traceable. Currency-specific reports avoid adding unlike currencies into a misleading total.
Payments and secrets
Paddle provides the checkout and merchant-of-record layer. Full card data is not stored by Invoice Maker. Production configuration remains outside the repository, and the application container receives only the runtime values it needs. Sensitive provider credentials are not exposed to public pages. Checkout displays the final price and taxes before authorization.
Backups, export and deletion
Production deployment includes a database backup before containers are recreated. Customers can download a complete JSON workspace archive and CSV records. A guarded deletion flow removes active workspace data after confirmation while explaining that identity-provider and payment-provider records follow their own legal and contractual retention rules.
Customer responsibilities and reporting
Use a unique password, protect email and identity-provider access, review authorized devices and avoid sharing documents containing unnecessary personal data. No system is risk-free. If you find a potential vulnerability, follow the coordinated-reporting instructions on the contact page. We do not claim a certification that has not been independently verified.