Skip to content

Free webinar, 4 November, 9pm: envoice with Zoho Books and Zoho CRM, live demo by Aplikasi. Register

Trust

Security

Last updated: 2026-10-27

Encryption

•Your LHDN MyInvois Client Secret is encrypted at rest with AES-256-GCM.
•Access tokens for connected apps, such as Zoho and Loyverse, are encrypted at rest with AES-256-GCM.
•Buyer ID numbers, emails, phone numbers and addresses on your e-invoices and saved customers are encrypted at rest.
•envoice.my is served only over HTTPS. Browsers are told to always use HTTPS (HSTS), and sign-in cookies are sent only over HTTPS.

API keys

•API keys are stored only as SHA-256 hashes. The full key is shown once, when you create it.
•The API and MCP server need a Pro or Enterprise plan. Each key belongs to one shop, and you can revoke it at any time.

Access

•Each shop has three roles: Owner, Accountant and Staff. Only the owner invites or removes members and manages billing. Staff cannot cancel e-invoices or change settings.
•When you open envoice from the Shopify app, changing your email, password, linked logins, LHDN credentials or shop members first needs a sign-in link sent to your email.
•envoice staff tools open only to a short list of named email addresses, and only once that address is verified.

Filing with LHDN

•envoice files through LHDN's official MyInvois API with your business's own Client ID and Client Secret.
•envoice uses the unsigned MyInvois v1.0 API, so no digital signing certificate is needed.

Payments

•Card details are entered on the Stripe or CHIP checkout page and never reach envoice.

Hosting and backups

•The app and database run in a data centre in Singapore.
•The database is backed up every night. Backups are encrypted and stored off-site.

Privacy

•Personal data is handled under Malaysia's Personal Data Protection Act 2010 (PDPA). The privacy policy lists what we collect, why, how long we keep it and every processor we use.
•To delete your data, email privacy@envoice.my.

Report a vulnerability

•Email privacy@envoice.my with the subject "Security". Include the steps to reproduce it.
•Please do not access other customers' data or disrupt the service while testing.