Security & Compliance

Card numbers, CVCs, expiry dates, and bank account numbers are entered directly into Stripe Elements — a secure, iframe-based checkout widget that runs entirely within Stripe's infrastructure. Those values are never transmitted to Win!'s servers and are never written to our database.

What we store is only what Stripe gives back after tokenisation: a payment method ID, the card brand, the last four digits, and whether the charge succeeded. No raw numbers. No CVCs. Ever.

Win! stores only the minimum necessary to operate the service:

• Your account email, business name, and branding preferences
• Invoice metadata synced from Xero or QuickBooks Online — invoice numbers, amounts, due dates, customer names and emails
• Payment references returned by Stripe after a successful charge (e.g. payment intent IDs, last-4, card brand)
• Accounting sync records — timestamps and outcomes of when invoices were marked paid in your books
• Encrypted OAuth access and refresh tokens for Xero, QuickBooks Online, and your Stripe Connected account
• Operational logs — request metadata used for debugging, security monitoring, and fraud prevention

We do not store, request, or have access to your Xero or QuickBooks Online password, your Stripe password, payroll data, payroll journal entries, bank feed credentials, or any data outside the OAuth scopes you explicitly grant.

Win! connects to your accounting platforms using OAuth 2.0. We request only the minimum scopes necessary to import invoices and reconcile payments:

• Xero — invoice and contact read/write, settings read, offline access
• QuickBooks Online — accounting read/write, openid profile
• Stripe — Connected Account (you authorise charges on your own Stripe account; we never receive your Stripe password or have access to your Stripe dashboard)

You can revoke Win!'s access at any time from the Connections page inside Win!, or directly from your accounting platform:

• Xero: My Xero → Connected Apps
• QuickBooks Online: Settings → Apps → My Apps
• Stripe: Settings → Connected Apps

When you disconnect a platform or delete your Win! account, we immediately delete the associated OAuth tokens from our database and revoke them with the provider so they cannot be used again.

• Merchant accounts — protected by email-based multi-factor authentication (MFA). After signing in with your password, you receive a one-time code by email that must be entered before accessing the dashboard. Trusted devices are remembered for up to 60 days.
• Administrative access — Win!'s internal administrative panel requires multi-factor authentication and is restricted by email allowlist.
• Database access — production database access is restricted to named engineers and is audit-logged. Direct database queries require VPN and multi-factor authentication.
• Field technician access — technicians use a separate, invite-only login with a scrypt-hashed PIN. They can only create invoices and see their own history — they have no access to your dashboard, books, or billing information.

If we confirm a security breach that compromises personal data, we will notify affected merchants within 72 hours and, where required by applicable law, notify the relevant supervisory authority.

Notifications will be sent to the email address on your Win! account and will include: what happened, what data was involved, what we have done to contain it, and what you should do next.

If you believe you have found a security vulnerability in Win!, please report it to us before disclosing it publicly. We aim to acknowledge all reports within 2 business days and resolve confirmed vulnerabilities promptly.

Security contact: contact our support team

Please include a description of the issue, steps to reproduce it, and the potential impact. We do not currently offer a formal bug bounty programme, but we do recognise researchers who report valid findings responsibly.