Per-tenant isolation at the database layer
Row-level security policies scope every query to the account that made it. A request that tries to reach another tenant's invoice, client, or expense is refused before the application ever sees it.
Trust
Your business records, yours.
Trust is what a platform actually does, not what it promises. Here is what PayNext does — separation, access, integrity, and the freedom to leave with everything you brought.
Isolation
Every account is its own island.
Separation isn't a rule we ask people to follow — it's enforced by the database on every single read and write.
Accountant seats stay in their lane
An invited accountant sees only the account that invited them — invoices, expenses, and receipts, nothing else. There is no cross-tenant view, even inside the accountant portal.
No shared login, no shared history
Each user has their own credentials. Actions are attributed to the person who took them, not to a shared team account.
Access
Getting in takes more than a password.
Especially when someone else's books are on the other side of the door.
Mandatory 2FA on accountant access
Accepting an accountant invitation requires two-factor authentication to be enabled. It is not optional and cannot be skipped.
Optional 2FA on owner accounts
Owners can enable time-based one-time passwords from Security settings. Recovery is handled through verified email.
Encrypted in transit
Every connection to PayNext runs over TLS. Emails leave through authenticated transports.
Integrity
Once it's sent, it doesn't quietly change.
A ledger only means something if the numbers on it can't drift after the fact.
Invoice immutability after sending
Once an invoice leaves draft, its totals, line items, and VAT treatment are locked at the database level. Status can still move — paid, overdue, cancelled — but the financial content of a sent invoice is fixed.
Append-only audit logging
Sensitive actions — logins, exports, edits, refunds, access grants and revocations — are recorded to an audit trail that only adds and never rewrites. There is no button anywhere in PayNext to erase a log entry.
Gap-free numbering
Invoice numbers are sequential per account and survive every account event. There are no silent renumbers and no hidden gaps.
Portability
You can leave with everything you brought.
The strongest sign software respects you is how easy it is to walk away from.
One-click export
Invoices and expenses download as CSV, and the accountant export bundles both alongside every receipt file as a single ZIP — ready for the tax file with no assembly.
Self-service deletion with a grace window
Request account deletion from Settings. We confirm by email, then hold the request for 30 days so you can undo it with one click. After the window closes, your data is removed.
30-day retention for lapsed accounts
If a paid account lapses and is not reactivated, the workspace locks and one page remains reachable — a full data export. Records are retained for 30 days from that moment, with weekly reminders and a final 48-hour notice, so you have every opportunity to export or reactivate before deletion. Accounts that never paid and stay inactive are removed after 14 days.
Reporting
Found something we should fix?
If you believe you've found a security issue in {{brand}}, please write to the team at info@d-way.com. We acknowledge every report and coordinate disclosure with the reporter.