Psilocon Valley handles invoices, client data, and payments for independent businesses. Security is not a feature we added โ it is the foundation we built on. Here is exactly what we do to protect you and your clients.
Authentication
The strongest password hashing algorithm available. Your password is never stored โ only an irreversible hash. Even we cannot read it.
Every session cookie is cryptographically signed. Forged or tampered cookies are rejected before they reach your account.
IP-based sliding window rate limiting blocks brute force attempts on login, registration, and password reset endpoints.
After 10 consecutive failed login attempts, the account is temporarily locked to prevent automated attacks.
Password resets use single-use, time-limited magic links with cooldown periods to prevent abuse.
Sign in with Google delegates authentication to Google's infrastructure โ no password stored on our side at all.
Transport & Infrastructure
All traffic is encrypted with TLS. There is no HTTP fallback โ ever.
HTTP Strict Transport Security is enforced for 2 years, including subdomains, and submitted to browser preload lists.
Content Security Policy, X-Frame-Options, Permissions-Policy, and Cross-Origin headers are set on every response.
Every form is protected with a cryptographic CSRF token. Cross-site request forgery attacks cannot succeed.
Payments
All payments are processed by Stripe โ the same infrastructure trusted by Amazon, Google, and millions of businesses worldwide. We never see, handle, or store card numbers, bank account details, or CVCs. Payment data goes directly from your client's browser to Stripe's servers.
Stripe is PCI DSS Level 1 certified โ the highest level of payment security certification available. Our integration uses Stripe Connect, meaning your earnings are held and transferred directly by Stripe, not routed through our accounts.
Privacy
We do not sell your data. We do not share your client list with anyone. We do not run Google Analytics, Facebook Pixel, or any third-party advertising trackers. We do not use your invoice data to train AI models or for any purpose other than running the product you signed up for.
Your clients' names, emails, addresses, and payment history are yours. We hold them in trust. We protect them. We never monetize them.
Current Status
Contact
If you discover a security issue, please report it responsibly. Email us directly at security@psiloconvalley.com. We take every report seriously and respond within 48 hours. We do not pursue legal action against good-faith security researchers.
Professional invoicing, built on a secure foundation. Free to start.
Create Free Account โ