Security

Du3 handles invoices, bank details and tax IDs, so we treat security as part of the product.

Your data stays with your company

• Every company’s data is kept separate. Every request — from the web, the app, Slack or Discord — is checked against the company it belongs to.
• Du3y works out which company you are from the verified workspace (Slack workspace or Discord server) the request came from, never from what anyone types. It can’t be talked into showing another company’s data.
• Replies in Slack always use your own workspace’s connection.

Encryption

• All traffic uses HTTPS (TLS).
• Data is encrypted at rest.
• Bank details, tax IDs and the tokens that connect Du3 to Slack and WhatsApp get an extra layer of encryption.
• We never send the bank details or tax IDs stored in Du3 to AI models.

Access and roles

• Only owners and admins can edit, delete or mark invoices paid, unless an admin gives a team member those Du3y commands. We check this on our servers for every action.
• Contractors only ever see their own invoices.
• Every change to an invoice is logged with who did it and where.
• Du3 staff access is limited to what they need, and every change staff make is logged.

Public links and branded sites

• Submission links can expire or be single use.
• Public forms are rate-limited.
• Every uploaded file is scanned for malware before anyone can open it.
• A branded site’s home page is checked by us before it goes public, and it has a “Report this site” link.

Payments

Card details are handled by Paystack, or by Apple or Google for plans bought in the Du3 app. They never touch our servers.

Backups and recovery

We back up data every day and keep backups for 7 days. Deleted invoices can be restored for 30 days.

Report a security issue

Found a vulnerability? Please email [email protected] with the details. Give us reasonable time to fix it before sharing it publicly, and don’t access other people’s data while testing. We’ll reply within 3 working days.