Security and data
In short
- Nothing is emailed to your customers until someone on your team presses send.
- Reminder reads your open invoices, customers and payments. It writes to your books in one case only: recording a payment your customer made through a Reminder pay-now link.
- Reminders go out from your own email domain, and replies come back to your inbox.
- Connection tokens are encrypted, and each company's data is kept apart from every other's.
- We sign a data processing agreement with any customer who asks.
Access to your accounting software
You connect QuickBooks, Xero or Zoho Books through their own sign-in screen, which lists what Reminder is asking for. You can disconnect from Reminder's Settings, or from your accounting software, at any time.
- Xero: read invoices, read contacts, read settings (to find the bank account a payment goes to), and create payments.
- Zoho Books: read invoices, read contacts, read and create customer payments, read settings.
- QuickBooks: Intuit offers a single accounting permission, so the consent screen shows full accounting access. Reminder uses it to read invoices, customers and payments, and to record pay-now payments, nothing else.
Reminder never edits or deletes an invoice, a customer or anything else in your books. The only thing it writes is a payment, when your customer has paid through a Reminder pay-now link, so your books and Reminder agree. A payment that came from your books is never written back to them.
What reaches your customers
Reminder drafts. You decide. Every reminder waits for someone on your team to review it and press send, and you can edit or skip any customer before it goes.
Reminders are sent from your own domain once you have added the DNS records Reminder gives you, so your customers see your name and address, not ours. Their replies go to your inbox. Anyone who unsubscribes is never emailed again from your account.
Where your data is kept
The application runs on Vercel and the database on Supabase (PostgreSQL), both in Singapore. Invoice PDFs are stored in Amazon S3. The full list of providers, and what each one does, is in our privacy policy.
Where personal data of people in the EU, EEA or UK leaves those areas, we rely on the European Commission's Standard Contractual Clauses and, for certified US providers, the EU–US Data Privacy Framework.
How it is protected
- Encrypted in transit (TLS) and at rest.
- The tokens that connect Reminder to your accounting software and your bank are encrypted with AES-256-GCM before they are stored, and never logged.
- Passwords are hashed with bcrypt and never stored as written.
- Every query is scoped to your company: one customer's data cannot be read from another's account.
- Three roles on your team: Admin, Finance and Viewer. Viewers can see but not send.
- Errors are monitored (Sentry) so problems are found before you report them.
AI and your documents
If you upload invoice PDFs rather than connecting your books, Reminder uses Anthropic's Claude API to read them. Under our API agreement, Anthropic does not use that data to train its models. You review what was read before anything is sent.
Data processing agreement
For your customers' details (names, email addresses, invoices), you are the controller and Reminder is your processor. We sign a data processing agreement with any customer who asks: email privacy@usereminder.com.
Leaving Reminder
Disconnect your accounting software at any time. When you close your account, your data is deleted or anonymised within 90 days, except records the law requires us to keep. Details are in the privacy policy.
Reporting a security issue
If you think you have found a vulnerability, email support@usereminder.com with “Security” in the subject. We reply within two working days and ask that you give us a chance to fix it before making it public.