Security Statement

Our approach

InvoWay handles tax-relevant business data, so security is built into the design of the gateway. This statement summarises our measures. To report a vulnerability or ask a security question, email arif@maq-solutions.com.

Data in transit

All API and website traffic is carried over HTTPS/TLS. Transmission to Accredited Service Providers uses secure channels with signed UBL 2.1 payloads.

Access control

• Tenant-scoped API keys or OAuth 2.0 for API access.
• Strict separation of customer (tenant) data.
• Least-privilege access for staff, limited to what the role requires.

Application security

• Server-side validation and sanitisation of all external input.
• Rate limiting on public endpoints, including the demo request form, to reduce abuse.
• Secrets such as credentials and keys are held in environment configuration, never in source code.
• Error responses avoid exposing internal details.

Data integrity and audit

Invoice lifecycle states and transmissions are recorded in audit logs, with payloads and ASP acknowledgements retained to support reconciliation and regulatory review. Pre-flight schema and calculation checks reduce rejected submissions.

Infrastructure

We host on Microsoft Azure infrastructure with managed PostgreSQL, using separate development, staging and production environments.

Privacy and retention

We process personal data as set out in our Privacy Policy and keep records only as long as required.

Incident response

We investigate suspected security incidents promptly and, where required by law or contract, notify affected customers and authorities without undue delay.

Responsible disclosure

If you believe you have found a vulnerability, please email arif@maq-solutions.com with details. Please give us reasonable time to fix the issue before public disclosure and do not access data that is not yours.

Contact us

Security questions? Email arif@maq-solutions.com or write to InvoWay Technologies FZ-LLC, The Goal Craft, Office No: 106, Sultan Group Investment Building, Port Saeed, Deira, Dubai, United Arab Emirates.