Security features in Slate

An invoicing system holds a business's books, its customer list, and the ability to issue a document someone else deducts tax against. Security here is not a layer added at the end; it decides what the structure looks like from the start. This page collects the security features implemented in Slate and what each one gives you in practice.

Full separation between businesses

Every piece of data belongs to the account that created it, and the separation is enforced server-side rather than in the display layer. No path lets one business's request reach another business's data, including internal management screens and the AI features.

A digital signature on every issued document

A fiscal document is signed with an Ed25519 signature the moment it is issued. The signature covers the fields that decide what the document says: number, type, line items, totals, VAT, customer details and business details. Changing any one of them after issue breaks verification, visibly, for anyone who checks.

An issued document stays as it was

Alongside the signature, a permanent snapshot of the document is stored: business details, logo, customer details and the language it was issued in. Viewing or reprinting always works from that snapshot rather than from current settings, so updating details or changing a logo later never alters a document already sent to a customer.

Public verification by QR scan

Every document carries a QR code leading to an open verification page. The customer, the accountant, or anyone who received the file can check for themselves that the document is genuine and unaltered, with no account and no login. The page returns only what answers that question: signature validity, document number, business name, signing time and amount. Line items and customer details are not exposed there.

Gapless numbering

Document numbers are claimed server-side at issue time, inside the same operation that writes the document. An issue that fails midway returns the number instead of burning it, so the sequence stays intact as the law requires, including when several documents are issued at once.

An issued document cannot be edited or deleted

A fiscal document that has been issued is final. There is no path to edit or delete it in the interface, and no path through the support team or internal management screens either. Corrections are made with a new document, a credit note for example, which is exactly what the law expects.

Passwordless login

Signing in uses a one-time code sent by email. There is no password column in the system, encrypted or otherwise, so there is no password store to steal, brute-force, or guess from a password leaked elsewhere. Codes are valid briefly, stored one-way encrypted, and invalidated after use.

The system also does not reveal whether an email address has an account. The real answer is given only after the code has proven control of the mailbox, so there is no way to find out from outside which businesses are customers.

Short sessions and immediate revocation

A session ends when the browser closes and expires on its own shortly after, so returning to the app means proving mailbox control again. There is also a mechanism that cuts off every open session of an account at once, triggered automatically when an account is closed and on any sensitive change to its permissions.

Encrypted secrets in the database

Sensitive connection details, such as the connection to the Tax Authority, are encrypted with AES-256 in the database. They are never shown as plain text on any management screen and are never returned in any response.

Read-only support access

When the support team enters an account to investigate an issue, access is time-limited and every write is blocked server-side. Nobody on our side can issue, edit, delete or send on your behalf. Who is allowed in that way is re-checked on every action rather than only at entry.

Browser protections

The app loads under a policy that restricts exactly which resources the browser may run and where it may connect, alongside headers that prevent the system being embedded in another site, file-type guessing, and address leakage. Camera, microphone and payment are disabled at the browser level. PDF generation runs in an isolated environment with no code execution at all.

Rate limits

Sensitive endpoints, login first among them, are rate-limited per email address and per request source. The limit is keyed on a source identifier the caller cannot choose, so high-volume guessing is blocked rather than routed around.

Input control

Every stored field passes an explicit allowlist and shared length limits enforced on both the server and the interface, so there is no way to push a field into a record that was never meant to be written. Files and imports are checked before processing and capped in size, compressed files that try to expand in memory included.

Activity log

Every meaningful action is recorded server-side: issuing, cancelling, requesting an allocation number, importing, and every verification check anyone runs against your document. A document's log is visible in the interface, so you can see what happened to it and when.

AI that suggests, never writes

Every AI feature in the system, from receipt recognition to document drafting to the assistant that answers questions about your books, produces a draft only. No AI path writes on its own to a document, an expense or a message to a customer, and explicit human approval is always required. Beyond control over the result, this is what stops information arriving from an image or an external file from becoming a fiscal record no person ever looked at.

The data and who owns it

The database is hosted in Europe, close to Israel in response time and subject to European privacy regulation. No copy of the data runs at a third-party vendor for marketing purposes.

Fiscal documents are kept for seven years as Israeli law requires, even if the account is closed, and that is built into the data model rather than left as a policy someone could forget. In the other direction, you can export the full record set at any time in the Tax Authority's Open Format, the same format an audit asks for. Leaving Slate does not leave the books locked in.

Share