Draft for review
Legal
Security at TripleBill.
Effective 5 September 2026. A plain description of what we do to protect your data, and what we do not claim.
In place today
- All traffic over HTTPS
- Passwords stored as salted hashes; sessions stored as hashed random tokens
- Role-based access with per-user permissions and branch restrictions
- Audit log of user actions and denied permission attempts
- Server-side checks on every write, not just hidden buttons
- Regular database backups
- Secrets kept out of the codebase and configured only on the server
Triple AI
- The assistant can only call predefined actions, each permission-checked
- Drafts are booked only after you confirm
- Requests to the model include only the records needed for the answer
What we do not claim
We do not claim specific certifications (such as ISO 27001 or SOC 2) or "100% security". If we obtain a certification we will say so here.
Reporting a vulnerability
Email support@triplebill.app with details. We will acknowledge and work with you to fix it.
Related
Your first invoice is two minutes away.
Free plan, no card, real double-entry books underneath.