Security

Last updated: August 8, 2026

Your invoices and customer records are business-critical. Here's how CustomerTab protects them.

Infrastructure

• CustomerTab runs entirely on Amazon Web Services (US East region).
• All traffic is encrypted in transit with TLS 1.2+.
• All data is encrypted at rest.
• Point-in-time recovery backups are enabled on every database table, letting us restore data to any second in the last 35 days.

Account security

• Passwords are hashed with PBKDF2 (120,000 iterations) and per-user salts. We can never see your password.
• Sessions use random 256-bit tokens that expire automatically.
• Sign-in, signup, and password-reset endpoints are rate-limited to slow down brute-force attacks.
• Password reset links expire after one hour and can only be used once.

Data isolation

Every business gets its own isolated workspace. All data is keyed by business ID, and every API request is checked against the signed-in user's current membership — one business can never read another's customers, invoices, or settings. Team members join only through invite links you generate, and you can revoke access at any time.

Payments

Card payments are handled end-to-end by Stripe, a PCI DSS Level 1 certified processor. Card numbers never touch CustomerTab's servers. Online invoice payments go directly to your own Stripe account.

Email

Invoice and reminder emails are sent through Amazon SES with SPF and DKIM authentication on the customertab.com domain.

Monitoring

We run automated alerts on API errors, email failures, and background job health so problems are caught quickly.

Reporting a vulnerability

If you believe you've found a security issue, email support@customertab.com with details. We take reports seriously and will respond as quickly as we can.