Security

• Your password is not ours to lose. Sign-in is handled by Google Firebase Authentication. Billbana’s own database never stores your password in any form.
• Email verification is mandatory. An account whose email address has not been verified cannot open a session at all — this is enforced on our servers, not merely in the interface.
• Sessions can be revoked. Changing your password or signing out invalidates existing sessions, so an old session cannot be resumed.

• The session cookie is HttpOnly, so scripts running in your browser cannot read it.
• It is marked Secure in production, so it is only ever sent over an encrypted connection.
• It is restricted to Billbana’s own site, so it is not sent to anyone else.
• It expires after five days, so an abandoned session does not stay usable indefinitely.
• It is verified on our servers on every request for your data, including a check that it has not been revoked. A tampered or expired cookie is rejected outright.

Before any record is read, our server establishes who you are from your verified session and then scopes the request to your own business. A record is never fetched by its identifier alone.

In practice this means that guessing or altering an identifier in a URL does not reveal another user’s invoice, customer or product — the request simply finds nothing.

• All traffic is served over HTTPS.
• Browsers are instructed to use HTTPS for this site in future, so a plain HTTP request is not made even once.
• Data is stored with established infrastructure providers — Google Firebase and a managed PostgreSQL service — which encrypt stored data. They are listed in our Privacy Policy.

Billbana sends a strict set of security headers with every page, including a Content-Security-Policy. Among other things it means the application loads no third-party scripts at all — no analytics, no advertising, no widgets, no tag manager. There is no third-party code running on the page where your invoices are.

The site also refuses to be displayed inside a frame on another website, which blocks a common category of click-hijacking attack.

We keep server logs to diagnose errors and to investigate sign-in and access failures. They are written so that passwords, tokens, session cookies and similar values are stripped out before anything is recorded, and a mobile number is masked to its last two digits.

The most effective protections are the ones only you can apply:

• Use a password you have not used anywhere else, and keep it to yourself. We will never ask you for it.
• Sign out when you finish on a shared or public device.
• Be wary of emails asking you to “verify” by entering your password on another site. Billbana never asks for card or bank credentials — it is free and takes no payments.
• Download PDFs of invoices you need to keep. Your own copy is the best backup there is.

We would rather be straightforward than impressive:

• We hold no security certification — no ISO 27001, no SOC 2 — and we have not published an independent audit. We are not going to imply otherwise.
• We do not guarantee uninterrupted or error-free service, and no online service can promise perfect security.
• Please keep your own copies of records you need. See our Terms of Use.

If you believe you have found a vulnerability, please tell us at info@intelliob.com with enough detail to reproduce it. We will acknowledge your report and keep you informed while we look into it.

Please report it privately rather than publicly in the first instance, and please do not access, alter or delete data belonging to anyone else, or run tests that would degrade the service for other users.

We do not currently operate a paid bug-bounty programme, and we would rather say so than leave the impression that one exists. We are genuinely grateful for responsible reports.