PayToMe security: how we protect your data

PayToMe security starts from a simple idea: the safest data is data we never collect. This page describes what we do today to protect visitors to this website, how accounts and payments are handled, and how to report a problem. PayToMe is in public beta. We say so where a protection is not in place yet.

PayToMe security: what is in place today

Encrypted connections

The website is served over HTTPS. We also send an HTTP Strict Transport Security (HSTS) header, which tells browsers to use HTTPS for future visits to the site.

Strict browser protections

We send a strict Content Security Policy (CSP) and other security headers. A CSP limits which scripts, styles and connections a page may use, which reduces the damage if someone tried to inject malicious code. The site loads no third-party scripts.

No cookies and no trackers

The website sets no cookies and runs no analytics or advertising trackers. There is no tracking script to leak, sell or misuse.

Generator data stays in your browser

The free tools, such as the invoice generator and the late fee calculator, run in your browser. What you type into them, including client names, line items and amounts, is not sent to our servers. See all of them on the tools page.

Newsletter data

The newsletter is optional. If you join it, we store your email address, the time you signed up and the page you signed up from. The website is hosted on Cloudflare, which also runs the database that holds newsletter signups. Emails are sent through Resend. These two companies process data on our behalf. What we store and why is described in the privacy policy.

To limit abuse of the newsletter form, we keep a salted hash of the IP address instead of the raw address.

Sign-in

People have accounts at app.paytome.si. You sign in with a passkey, a wallet or a code sent to your email address. A passkey means there is no password to guess or phish. We never ask you for a passkey, a wallet recovery phrase or a sign-in code by email, so treat any message that does as suspicious.

Payments

Payments are processed by Stripe. PayToMe does not store card numbers. Paid plans are subscriptions billed by Stripe, and you can cancel any time.

Safe AI

The Via assistant prepares invoices and asks before sending. Totals are calculated by PayToMe’s invoice engine, not by the AI model. Via is live in beta.

What is in development

These items are in development and are not live yet.

• The mobile app. It is in development, and this page will be extended to cover it when it goes live.

We will not claim a certification, such as SOC 2 or PCI DSS, until we hold it.

Reporting a vulnerability

We welcome reports from security researchers and from anyone who spots something odd. Our contact details follow RFC 9116, the standard for a security.txt file, and are published at /.well-known/security.txt.

To report an issue, email security@paytome.si with:

1. A description of the issue and its impact.
2. Steps to reproduce it, or a proof of concept.
3. The page address or component affected.
4. How we can reach you, if you want a reply.

Ground rules

• Test only against your own data and sessions. Do not access, change or delete data that belongs to others.
• Do not run denial-of-service tests or send spam through the newsletter form.
• Give us reasonable time to fix the issue before you share details publicly.
• Do not use social engineering against anyone.

If you follow these rules, we will treat your report as made in good faith. We will read every report and work on confirmed issues.

No bug bounty yet

PayToMe does not run a bug bounty program at this time, so we cannot offer payment for reports. We can offer thanks and, with your permission, credit once an issue is fixed. If we start a program, this page will say so.

Things you can do

• Use a current browser, so that it enforces the protections we send.
• If you receive an email that claims to be from PayToMe and asks for a password or payment details, do not respond. Forward it to security@paytome.si.
• Remember that the generators keep your data in your browser, so clearing site data or closing the tab removes it.

Questions

For anything not covered here, see the contact page or read about our approach on the about page.