Security is part of the product.
Your invoices and purchase records are your business’s books. This page says, specifically, what protects them. It lists what exists today and nothing else.
Your account
Signing in is handled by Firebase Authentication, a Google service. PlusGST never sees or stores your password.
- Email and password
- Accounts sign in with an email address and a password, with email verification and password reset by email.
- Two-step sign-in
- You can add an authenticator app (TOTP) in your profile. Once on, signing in needs the code from the app as well as your password.
- Deleting an account needs a fresh sign-in
- The server accepts an account deletion only from a session that signed in within the last five minutes, so a long-lived session left open cannot be used to erase your books.
Who can see your books
Every record, from an invoice to a vendor, belongs to one business. Access is decided by the database’s own security rules, not only by what the screen chooses to show.
- One business cannot read another’s
- Database rules allow a record to be read or written only by the owner of the business it belongs to and the people that owner has invited.
- Roles
- Owner, admin, editor and viewer. A viewer can read and cannot create or change anything.
- Your personal profile is yours alone
- The document holding your own details is readable only by you.
- Uploaded files are private to the uploader
- Bills, logos and signatures are stored under the account that uploaded them. Storage rules let only that account read or write them, check the type and size of an upload, and deny everything else.
What only the server can do
Some things are too important to be changed from a browser, even your own.
- Membership and ownership
- Who belongs to a business, their roles, and who owns it can be changed only by server routes that first verify the caller’s identity token.
- Your plan and billing state
- The subscription is written only by the server: after a verified payment, or a verified message from the payment provider. A browser cannot give itself a plan.
- App attestation
- Requests are attested with Firebase App Check (reCAPTCHA Enterprise), which helps confirm they come from the PlusGST app.
- Baseline protections on every response
- Pages cannot be framed by other sites, content types are not guessed, and API routes are rate limited per address.
A record of what changed
- Append-only activity log
- Each business has an activity log of who did what. The database refuses to edit or delete an entry, for everyone, the owner included.
- What it is, precisely
- Entries are written by the person’s own session at the time of the action, so the log is tamper-evident rather than a guarantee that nothing could ever be omitted.
- Issued invoices keep their details
- An invoice stores its own copy of your business details when it is issued, so later changes to your profile do not rewrite it.
Payments for your plan
- Handled by Razorpay
- Plan payments are made in Razorpay’s checkout. PlusGST does not receive or store your card or bank details.
- Verified before anything changes
- A payment is accepted only after its signature is checked and the order is read back from Razorpay. Messages from Razorpay are verified with a shared secret before they are read, and a repeated message is ignored.
Where it runs
- Google Firebase
- PlusGST runs on Firebase, part of Google Cloud: Authentication for sign-in, Firestore for data, Cloud Storage for files and App Hosting for the application.
- Encrypted connections
- The site and the app are served over HTTPS.
What we do not claim
PlusGST has not been audited against SOC 2, ISO 27001 or any other security standard, and holds no security certification. No system is free of risk, and we would rather tell you what is in place than hand you a badge.
Reporting a problem
There is no separate security address yet. If you find a weakness, or something about your account looks wrong, write to support@plusgst.com and mark it as a security report. See also the Privacy Policy.
Ready to make your next invoice?
Start with the Free plan and see how PlusGST fits into your day.