1. Security overview
PayTime handles sensitive business workflow data, including accounting connection metadata, invoice records, reminder activity, and billing state. The product is designed so users authenticate before connecting accounting providers, and production QuickBooks OAuth is only initiated from authenticated app screens.
We keep the system intentionally small: Cloudflare hosts the application, the database stores the minimum operational records needed to run reminders and billing, and third-party providers handle specialized areas such as payment cards and email delivery.
2. Encrypted accounting token storage
QuickBooks and Xero connections use OAuth. PayTime never asks for or stores your QuickBooks or Xero password.
OAuth access and refresh tokens are encrypted before storage using application-managed encryption keys. Tokens are only decrypted server-side when PayTime needs to refresh a connection, sync invoices, confirm payment status, or revoke access after disconnect.
3. Encryption in transit
PayTime is served over HTTPS. Browser traffic, accounting-provider redirects, app API calls, Stripe flows, and webhook endpoints are expected to use TLS in transit.
Cloudflare sits in front of the web application and provides TLS termination, edge protections, and secure delivery controls for the public website and application surfaces.
4. Stripe handles card data
PayTime uses Stripe for checkout, payment-method collection, subscription billing, customer portal access, receipts, and invoice/payment events.
PayTime does not store raw card numbers, CVC codes, or full payment-card details. The app stores Stripe customer, subscription, and billing-state identifiers needed to manage the subscription lifecycle.
5. Infrastructure and provider posture
PayTime relies on established service providers including Cloudflare for hosting and delivery, Stripe for billing, Resend for transactional email, and a managed Postgres provider for application data storage. These providers maintain their own security, compliance, and SOC 2 or equivalent assurance programs where applicable.
Provider assurance does not remove PayTime's responsibility for secure product design. We still restrict access, encrypt sensitive tokens, avoid storing card data, and keep production secrets outside the repository.
6. Access controls
Customer app pages require an authenticated session. Login uses email-code verification, and signing out of PayTime does not disconnect accounting integrations unless the user explicitly revokes the provider connection.
Internal debug and admin routes are limited to explicit allowlists. Production secrets are stored as Cloudflare Worker secrets or provider-side configuration, not in source code.
7. Reminder and billing safety
Reminder delivery can be placed in test mode for staging and controlled verification. Production reminder delivery is treated separately from code deployment so smoke tests can run before external emails are enabled.
First-recovery billing starts only after PayTime has imported an overdue invoice, actively chased it with at least one reminder, and later confirmed that invoice as paid through the connected accounting provider.
8. Responsible disclosure
If you believe you have found a security issue in PayTime, please contact support@paytime.today with a clear description, reproduction steps, affected URLs or accounts, and any supporting evidence.
Please do not access, modify, delete, or disclose other users' data. We will review reports in good faith and prioritize issues that could affect customer data, authentication, accounting tokens, payment flows, or email delivery.