How the encryption works
When you turn sync on, this browser creates a random key. Everything is locked with that key (AES-256) before it leaves your device, so our server only stores scrambled data. The key itself is never sent to us unlocked: we keep a copy locked with your recovery code, which only you see.
To add a device, scan a QR code from a device that's already synced, or type your recovery code. Signing in uses a one-time code sent to your email, so there's no password to forget or leak.
What syncs
- Every document in My invoices: invoices, quotes, estimates, receipts, credit notes and timesheets, with their status and payment dates
- Your business details, logo, signature and payment details
- Saved clients and saved line items
- What you entered in the tax, mileage and S-corp calculators
Job photos and the draft open on each page stay on the device where you added them. If you edit the same document on two devices, the most recent change wins.
Frequently asked questions
Do I need sync?
No. Invotaxa works fully without an account, and your documents stay saved in your browser. Sync is for people who want the same invoices on more than one device, or a copy that survives clearing the browser.
What if I lose my recovery code?
As long as one device is still synced, nothing is lost: open Sync settings there to see the code again or create a new one. If you lose every device and the code, nobody can unlock the synced data — not even us. That's the price of real privacy, so keep the code in a password manager or print it.
Can Invotaxa read my invoices?
No. We see your email address (to send sign-in codes), the names of your devices (for example "Chrome on Windows"), how much encrypted data you store and when it changed. The content is encrypted with a key we never have.
Is sync free?
Yes. Each account can store up to 50 MB of encrypted data, which is thousands of invoices.
How do I turn it off?
Choose "Sign out on this device" to stop syncing on one device; your documents stay there. "Delete my sync account" removes your encrypted data from our server and signs out every device.