Trust
Security at Involiqo
Involiqo is designed to protect business, financial and invoice information throughout upload, review and day-to-day use.
Security at a glance
Private invoice handling
Uploads are checked for file type and size, scanned for malware and kept in private storage.
Business-scoped access
Records are separated by workspace, and owners, managers and accountants get the access their role needs.
Reviewable and auditable
Invoices that read cleanly can be saved automatically and are marked that way; the rest are shown to you to check. Important changes are recorded.
Your data, exportable
Owners and admins can export transactions and invoice line items as CSV at any time.
On this page
Business-scoped access
Customer records are separated by business workspace. Database policies enforce business membership and role-aware permissions, while sensitive service credentials remain on trusted server infrastructure rather than in the browser.
Private invoice handling
Invoice files use private storage and a quarantine workflow. Uploads are checked for allowed file type, name and size, scanned for malware, and promoted to final storage only after a clean result. Direct customer writes to final invoice storage are blocked.
Reviewable AI extraction
AI-assisted extraction can make mistakes. Depending on the feature and settings, eligible results may be saved automatically; other results are presented for review. Check supplier, total and line-item information before relying on it for payments or accounts.
Where your data is hosted
The Involiqo database, private file storage and application run in Ireland, and invoice reading uses Google's EU location. The database is backed up daily.
Some suppliers, such as our AI and email providers, can process information outside the UK and EU under contractual safeguards. The Privacy Policy lists each supplier and where they process data.
Your invoices and AI training
Your invoices and business records are not used to train AI models. Model-training data sharing is turned off with our AI provider, and Google Document AI, which reads your invoices, does not train its models on the documents it processes.
Auditability and operational controls
- Important invoice, access and security events are recorded for investigation and accountability.
- Destructive and administrative actions are limited by role and require additional confirmation.
- Application errors exposed to users are sanitised to avoid leaking provider or credential details.
- Production dependencies and access-control policies are covered by automated and live checks.
Your responsibilities
Security is shared. Use a unique password, protect access to your email and devices, assign the minimum role each team member needs, remove access promptly when responsibilities change and review extracted information before accepting it.
Report a security concern
If you believe you have found a vulnerability, please report it privately and give us reasonable time to investigate before public disclosure. Include the affected URL or feature, clear reproduction steps and the impact you observed. Do not access data that is not yours, disrupt the service or use destructive testing.
Send the report to info@involiqo.com with the subject “Security report”.
This reporting channel does not create a bug-bounty programme or promise payment. We will acknowledge and assess good-faith reports as promptly as practical.
Privacy
For information about personal-data handling, retention and individual rights, read the Privacy Policy.