Security and data
Last updated 5 November 2026
Your invoice files
When you choose or drop a file, the browser reads it with the File API and Billtwin compares the two exports in the same tab. The files and their contents are never sent to our servers or to anyone else. Closing the tab clears them.
What our server stores
- Payment records sent by Paddle: transaction id, subscription id, status and price. No card details; Paddle holds those.
- Pilot requests you send: email, company, accounting system, invoice volume and your note.
- If you connect HubSpot or Xero: one encrypted refresh token per connection (see below). Never your invoices.
- Standard request logs kept by Cloudflare for operations. They hold no invoice data.
Connecting HubSpot or Xero (optional)
Instead of exports you can connect HubSpot or Xero when the check page shows a Connect button (we are opening this step by step; until then the check works with exports only). Billtwin asks only for read access to invoices: in HubSpot crm.objects.invoices.read, plus crm.objects.companies.read if you allow it, to show company names; in Xero accounting.invoices.read and offline_access. It cannot create, change or delete anything.
When you load invoices, our server reads them from HubSpot or Xero during that request and passes them straight to your browser, where the check runs. Invoice data is never written to a database, log or file.
The only thing we store is the refresh token that lets us read again, encrypted with AES-256-GCM, together with the HubSpot account id or Xero organisation it belongs to inside the same encrypted record. Short-lived access tokens are used inside one request and then dropped. Choosing Disconnect revokes the token at HubSpot or Xero and deletes the record; a record unused for 90 days expires, can no longer be used and is deleted. You can also remove Billtwin in HubSpot (Connected apps) or Xero (Connected apps) at any time. QuickBooks Online is checked with exports only.
Infrastructure
The site runs on Cloudflare Workers with HTTPS only and a strict content security policy. There are no advertising trackers; Cloudflare counts page views without cookies. Payments use Paddle.com as merchant of record, and Paddle scripts load only when you open checkout.
Report a problem
Email support@atesensoftware.com. We answer security reports within two business days.