InvoiceUAE by Infotree Computers LLC · UAE Peppol E-Invoicing Platform
This page explains, in plain terms, how InvoiceUAE protects your data. We've split it into two parts on purpose: what our hosting infrastructure provides versus what we ourselves have built into the application. These are not the same thing, and we don't want you to confuse one for the other.
InvoiceUAE is hosted on Hetzner Online GmbH infrastructure, in an ISO/IEC 27001-certified data center (Nuremberg, Germany). This certification covers the physical data center's information security management — power redundancy, physical access control, network security, and environmental controls.
Hosting provider (Hetzner) holds ISO/IEC 27001 certification for its data center operations.
DNS, DDoS mitigation, and TLS termination via Cloudflare's edge network in front of our origin server.
Important: this certification applies to the data center operator's infrastructure — it is not a certification of the InvoiceUAE application itself. See Section 5 below.
These are security measures implemented directly in the InvoiceUAE application by our team:
QuickBooks Online access uses Intuit's official OAuth 2.0 flow. We never see or store your QuickBooks password.
Sensitive stored fields (OAuth tokens, API credentials) are encrypted at rest using AES encryption before hitting the database.
User passwords are hashed with bcrypt (never stored in plain text), using a strong cost factor.
All traffic between your browser and our servers is encrypted in transit via TLS (HTTPS), enforced site-wide.
Authenticated sessions use signed JSON Web Tokens with a limited expiry, not long-lived static API keys.
Users are assigned roles (Admin / Accountant / Viewer) that gate which actions and data they can access.
An activity log records key actions (invoice submissions, syncs, user changes) with timestamps for traceability.
Login attempts, API calls, and sync operations are rate-limited to reduce brute-force and abuse risk.
Standard HTTP security headers (via Helmet) are applied to reduce common web attack surface.
InvoiceUAE only reads your QuickBooks data — it never writes, modifies, or deletes anything in your QBO account.
Invoice, customer, and company data submitted through InvoiceUAE is processed to generate UAE Peppol PINT-AE compliant XML and to maintain the audit trail required by the UAE Federal Tax Authority. We offer UAE data residency options for customers who require data to be stored within the UAE — contact us to discuss this.
Roadmap: as our enterprise and accounting-firm customer base grows, we plan to pursue formal SOC 2 Type II certification at the application level. This is a deliberate, cost-justified decision we'll revisit as real enterprise deals require it — not something we want to rush or misrepresent in the meantime.
If you believe you've found a security vulnerability in InvoiceUAE, please report it responsibly rather than disclosing it publicly:
We aim to acknowledge security reports within 2 business days.
If your organization's security or procurement team needs more detail than this page provides (architecture diagrams, data flow, sub-processor list), reach out via our Contact page and we'll respond directly — honestly, and without overstating what we've built.