Your invoices, client details, and payment records live in Fee-Lion. That’s not something we take lightly. This page explains — in plain English — how we protect your data, what we do (and don’t do) with it, and what happens if something goes wrong.

We’re not going to wave a SOC 2 report at you. We’re a growing product built for contractors, freelancers, and small studios, and we’re honest about where we are. What we can tell you is exactly how the system is built.

Encryption everywhere

In transit. Every connection to Fee-Lion — the app, the client portal, our API — runs over TLS 1.2 or higher. HTTP requests are redirected to HTTPS. There’s no way to talk to Fee-Lion in the clear.

At rest. Your database records, uploaded files (logos, attachments, signed proposals), and backups are encrypted at rest using AES-256. Encryption keys are managed by AWS KMS and rotated on a regular schedule. We don’t store plaintext copies of your data anywhere.

We never see your clients’ card numbers

Card payments run through Stripe. When a client pays an invoice, their card details go directly from their browser to Stripe’s servers using Stripe Elements. Fee-Lion’s servers never touch, log, or store a full card number, CVV, or bank account number.

What we do store is Stripe’s reference token for the payment — enough to reconcile the invoice, not enough to charge a card. Stripe is PCI-DSS Level 1 certified, which is the highest tier of card-data compliance, and offloading this to them is deliberate. Card data is a liability we don’t want, and neither do you.

Passwords and 2FA

Passwords are never stored in plaintext or in a reversible form. We hash them with bcrypt using a modern work factor, and we’re moving new accounts to argon2id. Even our own engineers can’t read your password out of the database.

If you forget it, we can only reset it — never recover it. Password reset links are one-time-use and expire quickly.

Two-factor authentication (TOTP) is available on every account. Turn it on in your account settings and pair it with any standard authenticator app (1Password, Authy, Google Authenticator, etc.). We strongly recommend it, especially for accounts with active Stripe payouts.

Your data belongs to you

This is worth saying clearly: the data in your Fee-Lion account is yours. We don’t sell it, we don’t share it with advertisers, we don’t train AI models on it.

You can export at any time:

Invoices and estimates — download as PDF individually or in bulk
Clients and contacts — export to CSV
Payments and financial data — export to CSV for your accountant or bookkeeping software
Full account export — request a complete archive of your account data by emailing support

If you cancel, your data stays available for export for 30 days, then is permanently deleted from our production systems. Backup copies age out on a 90-day cycle after that.

GDPR and your rights

If you or your clients are in the EU/UK, GDPR gives you specific rights over personal data. Fee-Lion honors all of them:

Right to access — get a copy of the personal data we hold about you
Right to rectification — correct anything that’s wrong
Right to erasure — ask us to delete your data (“right to be forgotten”)
Right to portability — receive your data in a machine-readable format
Right to object — opt out of specific processing

Requests go to [email protected] and we respond within 30 days, usually faster. We act as the data processor for information your clients give you through Fee-Lion, and you’re the data controller for that relationship.

If something goes wrong

We don’t pretend incidents can’t happen. Here’s what we commit to if one does:

Detection. Application logs, access logs, and infrastructure alerts are monitored continuously. Failed login patterns and anomalous access trigger alerts to our on-call engineer.
Containment. We have documented runbooks for revoking credentials, rotating keys, and isolating affected systems.
Notification. If your data is involved in a confirmed security incident, we’ll email you within 72 hours of confirmation — with what we know, what we’ve done, and what you should do. That timeline matches GDPR’s breach notification standard and applies to every Fee-Lion customer, EU or not.
Post-mortem. After the incident, we publish a plain-English write-up of what happened and what we changed.

To report a suspected vulnerability or security issue, email [email protected]. We read every message and respond within one business day.

Who we share infrastructure with

Fee-Lion is built on a small, deliberate set of trusted sub-processors. These are the only third parties that touch your data:

Sub-processor	What they do	Where
Amazon Web Services (AWS)	Application hosting, database, encrypted file storage, backups	US regions
Stripe	Payment processing, card data handling, payout management	Global
SendGrid	Transactional email delivery (invoices, receipts, notifications)	US

We’ll update this list if it changes, and material changes to sub-processors are announced by email before they take effect.

Practices behind the scenes

A few things we do that don’t fit neatly under a heading:

Production access is limited to a small number of engineers and requires SSO with hardware-key 2FA.
Dependencies are scanned continuously for known vulnerabilities and patched on a defined SLA (critical: 24 hours, high: 7 days).
Backups run daily, are encrypted, and are tested for restoration on a regular cadence.
We don’t use production data in development or staging environments.

Questions

Security isn’t a checkbox — it’s an ongoing conversation. If you have a question this page didn’t answer, or your own IT or compliance team needs more detail, email [email protected] and a real person will get back to you.

Suggested FAQs

Q: Is Fee-Lion SOC 2 certified?

A: Not yet. Fee-Lion is built for contractors, freelancers, and small studios, and we’re honest that a formal SOC 2 report isn’t in place today. What we can tell you is exactly how the system is built: TLS everywhere, AES-256 encryption at rest, bcrypt/argon2 password hashing, Stripe for all card handling, and a documented incident response process.

Q: Does Fee-Lion store credit card numbers?

A: No. Card payments are handled entirely by Stripe, which is PCI-DSS Level 1 certified. Card numbers, CVVs, and bank account details go directly from your client’s browser to Stripe and never touch Fee-Lion’s servers. We only store Stripe’s reference token so we can reconcile the payment to the invoice.

Q: How are passwords stored?

A: Passwords are hashed with bcrypt using a modern work factor, and new accounts are being moved to argon2id. Plaintext passwords are never stored or logged, and even our engineers can’t read your password out of the database. Password resets are one-time-use and expire quickly.

Q: Can I export my data?

A: Yes, at any time. Invoices and estimates export as PDF, clients and payment history export as CSV, and you can request a full account archive by emailing support. If you cancel, your data remains available for export for 30 days, then is permanently deleted.

Q: Do you support two-factor authentication?

A: Yes. TOTP-based 2FA is available on every account and works with any standard authenticator app such as 1Password, Authy, or Google Authenticator. We strongly recommend enabling it, especially for accounts with active Stripe payouts.

Q: What happens if there’s a security incident?

A: If your data is involved in a confirmed security incident, we’ll email you within 72 hours with what we know, what we’ve done, and what you should do. We follow the GDPR breach notification standard for every customer regardless of location, and publish a plain-English post-mortem after the fact.

Q: Who are Fee-Lion’s sub-processors?

A: Three: Amazon Web Services (hosting, database, encrypted storage, backups), Stripe (payment processing), and SendGrid (transactional email). These are the only third parties that touch your data. Any material change to this list is announced by email before it takes effect.

Security at Fee-Lion — How We Protect Your Data