Skip to content
Request early access

How Plirin keeps your business data safe

Plirin holds your invoices, customers and financial records. Here is how we protect them, described plainly.

Your account

  • Passwords are hashed with Argon2
  • Login, sign-up and password reset are rate limited
  • API keys are stored only as one-way hashes
  • Owner, Manager and Cashier roles, enforced on the server

Your data

  • All traffic is encrypted in transit over HTTPS
  • Database backups are encrypted and stored off-site every six hours
  • Business verification documents are encrypted with AWS KMS
  • Sensitive actions are recorded in an audit log, with who made them and when

The documents you send

  • Invoice and estimate links are random and cannot be guessed
  • An accepted estimate is recorded with a fingerprint of the exact version, the signer’s name, their IP address and the time
  • Issued invoices keep the tax wording they were sent with

Developers

  • Webhooks are signed with HMAC-SHA256, with replay protection
  • API create requests accept idempotency keys, so a retry never makes a duplicate
  • API requests are rate limited per key
When payments launch

Payments, without handing over your money

Card and stablecoin payments are in development. They are designed so that Plirin never holds your funds or your customers’ card details.

  • Card details never reach Plirin

    Card payments will run on your own Stripe account, through Stripe’s payment form. Plirin never sees or stores card numbers.

  • Stablecoins settle to your own wallet

    Plirin will never hold your funds: stablecoin payments go from your customer’s wallet directly to yours.

  • Verification and screening

    Taking payments will require business verification through Didit, and payout wallets are screened against OFAC sanctions lists when added and rescreened regularly.

Who handles your data

We publish every vendor that processes data for us, what each one receives and where it is based.

Sub-processor list Every vendor, what it receives and where it is based Data sharing policy What we share, why, and what we never share Privacy policy What we collect, how long we keep it and your rights
Found a vulnerability? Email security@plirin.com. We appreciate responsible disclosure and will respond within 48 hours.

Invoicing you can trust with your books

Join the waitlist and we’ll email you when your spot opens.

Request early access