Security
Last updated 22 October 2026
This page describes the protections that actually exist in the running software. We don't claim certifications we don't hold (no SOC 2 or ISO 27001), and no honest operator promises that breaches are impossible.
How your data is protected
- Tenant isolation in the database: every business is owned by one account, and the database itself checks ownership and paid-pilot status on every read and write — not just the interface. Direct API access by another customer returns nothing.
- Passwords: hashed by the authentication provider; we never store or see your password. Leaked-password checking is enabled for signups and password changes.
- Payment security: card details are entered only with Whop, the payment provider. Receivable Desk never sees, stores or transmits card numbers.
- Activation links: pilot activation tokens are derived from a server-only secret, stored only as hashes, expire, and are single-use.
- Webhooks: payment events are verified with the provider's signature scheme and re-checked against live provider state before anything changes.
- Response hardening: the site sends modern security headers (content-type protection, referrer limits, framing protection, a content security policy on the production site, and HTTPS-only transport headers).
- Least privilege: payment, entitlement and email-queue records are writable only by server-side components, never by browsers.
What we don't do
- No advertising or analytics trackers, no third-party scripts on page load.
- No storage of bank details, card numbers or government IDs — please don't import them.
Reporting a vulnerability
If you believe you've found a security issue, email cyle.heaney@receivabledesk.com with details. Please give us a reasonable opportunity to investigate and fix before public disclosure. We will acknowledge your report and keep you updated.
Incidents
Our incident-response and breach-notification process is documented internally and summarized in the Privacy notice, including authority and user notification within legally required timeframes.