CollectIQ handles your receivables, bills and bank connections, so we built it to protect them. This page explains in plain language how we do that.
These protections are built into CollectIQ and enforced by our servers and database, not just hidden on screen.
Every connection to CollectIQ uses HTTPS (TLS). Your data is encrypted at rest by our database provider. Bank connection tokens get an extra layer: each one is encrypted with AES-256 before it is saved, with a key kept separate from the database.
Before anyone connects a bank account or schedules a payment, CollectIQ requires two-step sign-in with an authenticator app. A stolen password alone isn't enough.
Each person in your workspace is an Admin or a User. Only Admins can connect banks, schedule payments, change payout or remittance bank details, connect accounting software or manage your team. If anyone else tries, they're refused and the attempt is recorded.
Every business's data is separated at the database level. Other CollectIQ customers can never see or change it, and no one can add themselves to your workspace. Only your admins can invite people.
Bill approvals, payments, bank connections, accounting syncs, team changes and changes to bank details are logged with who made them and when. Your admins can review the log at any time, and it can't be edited or deleted from the app.
On your payment page, CollectIQ's server sets the amount, the discount and where the money goes. Editing the link can't change any of them. Card and bank details go directly to Stripe and never touch CollectIQ.
Uploaded bills are kept in private storage and opened only through links that expire after 5 minutes. We check each file's real type, not just its name.
Connections use each provider's official sign-in. Connect links are signed, expire, and work only for the workspace and browser that started them. Access tokens are kept on our servers, never in your browser.
We work with established providers for the most sensitive steps. Each one receives only what it needs.
| Provider | What it does | What it receives |
|---|---|---|
| Stripe | Processes card and bank (ACH) payments to your business, and pays you out | Payment and payer details for each payment |
| Plaid | Connects your bank accounts so you can see balances and choose which account pays a bill | Your bank connection, from your bank, with your permission |
| Supabase | Database, file storage and sign-in, hosted in the United States | Your CollectIQ data |
| Netlify | Hosts the website and the secure server code | Requests as they pass through |
| Anthropic (Claude) | Reads uploaded bills and drafts messages for your review | The bill or text being read |
| QuickBooks, Xero | Sync with your books, only if you connect them | Invoices, bills, vendors and customers you choose to sync |
Automatic bill payment is coming soon through a licensed payments partner. When it launches, the partner verifies your business and moves the money; CollectIQ still never holds it.
What outside parties have verified, and what's next.
The providers that handle the most sensitive steps, Stripe, Plaid, Supabase and Netlify, each maintain independent SOC 2 audit reports. Stripe is also certified PCI DSS Level 1, the highest level for handling card data.
CollectIQ follows a written information security policy and data retention policy, and runs a monthly external security scan. CollectIQ does not yet have its own SOC 2 report. We'll say so here when we do, and share it with customers under NDA.
Good security is also about habits. These are ours.
We follow a written information security policy covering access control, encryption, vendors, incident response and data retention, and we review it every year.
Every account we use to run CollectIQ has two-step sign-in turned on. Secret keys live only in our hosting provider's secure settings, never in code or email.
Our code is scanned automatically for vulnerable libraries and leaked keys, and the live site gets an external security scan every month. Critical issues are fixed within 7 days and high-severity issues within 30.
The database is backed up every week. If a security incident ever happens, we contain it the same day and notify affected customers without undue delay, as the law requires.
People get only the access their work needs. When someone no longer needs it, it's removed the same day, and any keys they could see are rotated.
You can ask to see, export or delete your data. When you close your account, your data is deleted within 30 days, except records the law requires us to keep. See our Privacy Policy.
Email security@trycollectiq.com. If you think you've found a vulnerability, please tell us privately and give us a reasonable time to fix it before sharing it. We take every report seriously.