Security

Your data stays on your server

BillingEvo is self-hosted. Clients, invoices, payments, tickets and files are stored in your database and on your storage, not with Sitehandy. You decide where the server is, who can reach it and how it is backed up.

Signing in

• Two-factor authentication (TOTP) with recovery codes, for staff and client users. A superadmin can make it compulsory for all staff, or for specific accounts.
• Passkeys (WebAuthn), including hardware security keys such as YubiKey, for staff and clients.
• Accounts lock for 15 minutes after 5 failed attempts. An IP address is banned automatically after 3 failed staff logins, with a whitelist and email warnings.
• A hidden admin path you choose (for example /management instead of /admin), an idle timeout for staff, and a check that a staff session stays on the same IP address.
• A password policy, captcha on selected forms (hCaptcha, reCAPTCHA v2 or v3, Cloudflare Turnstile), and an option to disable staff password resets.

Protecting the application

• A Content Security Policy with nonces, without unsafe-inline or unsafe-eval.
• CSRF tokens on every form, and standard security headers.
• Every outgoing connection, to gateways, registrars, panels and webhooks, is checked so it cannot reach your internal network without staff approval, and TLS certificates are always verified.
• Service passwords, API keys and secret settings are encrypted in the database. Gateway, registrar and panel logs are redacted.
• Support for Cloudflare and trusted proxies, so the real IP address of each visitor is recorded.

Accountability

• An audit log of staff actions, logins and important changes, including logging in as a client and viewing a service password. It is kept for 2 years by default.
• Fine-grained permissions for every module. API roles can never exceed the permissions of the staff member who owns them.
• Bans by IP address, CIDR range, wildcard and email domain, with expiry dates.

Personal data tools

• Export one client’s data as JSON, or up to 100 clients as a ZIP.
• Anonymise a client while keeping the financial records you are required to keep, or anonymise inactive clients automatically after a number of months (off by default).
• Marketing consent with history, signed unsubscribe links, and opt-out from WhatsApp and follow-ups.
• Scheduled deletion of old email logs, gateway logs and login codes.

Backups

Daily automatic backups to SFTP, FTP, Dropbox or Google Drive, with optional AES-256 encryption of the archive and an email if a backup fails. The restore procedure is documented and has been tested.

What leaves your server

• Licence check, once a day by default: the licence key, the domain, an installation ID and the BillingEvo version. Nothing else.
• Connections you configure: payment gateways, domain registrars, DirectAdmin servers, WhatsApp providers, email servers, backup destinations and webhooks receive the data needed for the action you set up.

Reporting a vulnerability

If you believe you have found a security issue in BillingEvo, email [email protected] with the subject “Security: BillingEvo”. Please include:

• the BillingEvo version and a description of the issue;
• the steps to reproduce it, and what an attacker could achieve;
• any proof-of-concept code, screenshots or logs.

Please do not share the issue publicly, or test it against installations you do not own, until we have released a fix. Do not access, change or delete data that is not yours. We will confirm that we received your report, keep you informed while we work on it, and credit you in the release notes if you wish.

Security updates

Security fixes are released as new versions of BillingEvo and listed in the changelog. Keep your support and updates period active to receive them.