Non-Custodial Escrowless Flow
Funds flow wallet-to-wallet. We never store, pool, or freeze your crypto — private keys stay with you.
Zero Custody · Bank-Grade Encryption · OWASP Compliant
Built with Security First. Zero Hold on Your Funds.
Invoibase never holds customer private keys or funds. Every settlement is an on-chain transfer between client and freelancer — we verify, notify, and record. We do not custody.
Security pillars
Controls that protect funds and account integrity
On-Chain Verification
Multi-RPC node validation confirms transfers against expected wallets and amounts before invoices mark PAID.
Authentication & TOTP 2FA
AES-256-GCM encrypted TOTP secrets, bcrypt password hashing, and token versioning for instant session revocation.
Sensitive Action OTPs
Mandatory email OTP verification from [email protected] before password or payout wallet changes take effect.
OWASP Hardening
Defenses against SQLi, XSS, CSRF, and IDOR — backed by strict Content Security Policy headers and rate limiting.
Signed Secrets & Access Control
Signed on-ramp URLs, webhook signature verification, and role-gated admin surfaces keep privileged actions locked down.
Trust & compliance
Operational safeguards you can verify
- TLS 1.3 encryption in transit
- Strict Content Security Policy (CSP)
- API and auth rate limiting
- Automated audit logging for sensitive events
- Continuous error monitoring via Sentry
- Non-custodial settlement — no platform wallets hold user funds
- Webhook idempotency and signature verification
- Field-level encryption for 2FA secrets
Vulnerability reporting
Security researchers are welcome to report vulnerabilities responsibly. Contact our team and we will acknowledge receipt and work with you on remediation.
Email [email protected]