Should You Encrypt Your Invoices?
Most freelancers think encryption is for spies and people with something to hide. In practice it is for people with something to lose: a laptop, a backup drive, a client list. This page is the honest threat model.
Key takeaways
- Encryption at rest keeps data unreadable when the device leaves your control. That is the whole promise.
- It does not stop phishing, malware, or a plaintext PDF you emailed yourself.
- If the laptop ever travels, or clients are in sensitive fields, encryption stops being optional.
- An encrypted database with a plaintext backup is a plaintext database.
- LockMargin: AES-256-GCM on the database, Argon2id for the key, keys in the system keychain, no cloud.
What encryption protects — and what it does not
Encryption at rest does one job: it keeps data unreadable when the device leaves your control. A stolen laptop becomes a paperweight. A lost backup drive becomes a puzzle. That is the whole promise, and it is a good one.
I have replaced hard drives that still worked, lost USB sticks in transit, and pulled data off laptops that would never boot again. In every case the question was the same: if someone else finds this drive tomorrow, what exactly can they read? Encryption is the answer I could give without hesitation.
It does not do the other jobs. It does not stop phishing. It does not clean a malware-infected machine. It does not protect a PDF you emailed in plaintext. It does not help if your passphrase is "password123."
Encryption is a lock on the door. It does nothing if you hand the key to a stranger, or leave the window open.
Laptop loss and drive theft are far more common in a freelance life than a sophisticated cryptographic attack. Encrypt for the common failure, not the cinematic one. The full technical write-up is in how AES-256-GCM protects your client data.
The three questions of a freelance threat model
- Does the device leave the house? A cafe, a train, a client's office, a checked bag. If yes, the device will eventually be out of your sight. Encrypt.
- Whose data is on it? Your invoices hold client names, amounts, bank details, sometimes tax IDs. You are holding other people's trust in a file. That raises the duty of care — the GDPR guide explains why.
- What does a leak cost? For some professions a contract or a rule — lawyers have ABA obligations. For everyone else, a client who never calls again.
Answer those three and the decision makes itself. Most freelancers skip the questions and guess the answer. That is not a threat model. That is a hope.
| Threat | Encryption helps | It does not help |
|---|---|---|
| Lost or stolen laptop | Yes | — |
| Stolen backup drive | Yes, if the archive is encrypted | — |
| Cloud breach of your encrypted archive | Yes | — |
| Malware running under your account | — | Yes |
| Phishing and reused passwords | — | Yes |
| A weak passphrase | — | Yes |
When it stops being optional
There is a short list where encryption stops being a preference:
- The laptop travels. Any of it. Anywhere.
- Clients are in regulated or sensitive fields: law, medicine, finance, therapy.
- Your jurisdiction treats client data as your legal responsibility. GDPR calls it "appropriate safeguards."
- You store anything you would hate to see on a public forum.
When the law agrees with me
Data-protection rules point the same way. GDPR names encryption as the standard example of an appropriate safeguard. Regulated professions — law, medicine, finance — carry duties of care that make the question ethical, not just practical. And client tax IDs or social security numbers are regulated data in most jurisdictions. Encryption is rarely the law's only option. It is the option that ends the argument.
If you checked two or more boxes above, your setup is already in the risk zone. LockMargin encrypts by default — no configuration, no security checklist. See how it works >
How LockMargin does it
The database is encrypted with AES-256-GCM. The key is derived from your passphrase with Argon2id. The key lives in the operating system's secure credential store — Windows Credential Manager, macOS Keychain, or the platform equivalent — the same place your OS keeps Wi-Fi passwords. Not in a text file next to your invoices.
Why AES-256-GCM, in plain terms
AES-256 is the encryption standard banks and governments rely on. It protects confidentiality: without the key, the data is noise. GCM adds authentication: if someone changes even one byte of the encrypted database, decryption fails loudly instead of returning corrupted data. You learn about tampering at the moment it matters.
Argon2id turns your passphrase into a key. It is memory-hard: older key-derivation methods fall to GPU brute force. Argon2id was designed so that throwing hardware at it does not help.
And because LockMargin is local-first, the key never travels. There is no server to breach, no sync channel to tap. The attack surface is your machine, and only your machine. How we test all of this without a security team is a separate article: how we test encryption.
Honest limits: while you are logged in, the data is usable — that is the point. Malware running as you can read what you can read. And exports are only as safe as where you put them.
The part everyone forgets: backups
Here is the part everyone forgets. An encrypted database with an unencrypted backup is an unencrypted database. The thief does not care which copy they take.
- Encrypt the backup archive, or
- Keep the backup drive offline at home, or
- Both.
The 3-2-1 rule still applies. Encryption is what makes the offsite copy safe to store in someone else's cloud — the same logic as in the Dropbox article and the backup problem article.
How to encrypt a backup without LockMargin
On Windows, put the export folder into a 7-Zip archive with AES-256 and a strong password. On macOS, create an encrypted disk image with Disk Utility. Two rules: the archive password is not your cloud account password, and the password lives in a password manager, not in the same cloud folder as the archive.
Other financial records worth encrypting
Invoices are not the only files worth locking. The same logic applies to the rest of your financial paper:
- Invoices and estimates.
- Receipts and expense scans.
- Client contracts.
- Tax documents.
- Exported CSV and JSON.
- Backups of all of the above.
One rule covers them: if you would hate to see it on a public forum, it does not travel unencrypted.
The decision, in one table
| Your situation | Verdict | Why |
|---|---|---|
| The laptop ever leaves the house | Encrypt | The device will be out of your sight; theft is the common failure |
| Clients in sensitive fields (legal, medical, financial) | Encrypt | Duty of care; some of it is regulated data |
| Machine stays in a locked office, backups offline | Recommended, not urgent | Physical risk is low; the cost of encrypting is lower |
| Backups go to any cloud | Encrypt the archive first | The cloud copy is the copy a thief can reach |
| You email PDFs with bank details | Encrypt the PDF or the archive | Email is not a secure channel |
| You use cloud accounting | Export and encrypt your own copy | Their encryption model is theirs; your redundancy is yours |
| You store client tax IDs or SSNs | Encrypt | Regulated data in most jurisdictions |
If your data deserves sovereignty, the lock is part of it. And when you export, plain-text data means the exports stay yours too — with or without the tool.
Questions freelancers ask
Does encryption slow the app down?
Not in any way you would notice. Modern CPUs have hardware acceleration for AES, and the database is opened once per session. LockMargin still opens in milliseconds.
What happens if I forget my passphrase?
There is no backdoor and no recovery email. The data stays encrypted, forever. That is the deal. A password manager is the safest place for the passphrase. A sealed envelope in a physical safe is second best. A sticky note on the monitor is not a backup plan.
Is AES-256 overkill for invoices?
An invoice holds a client's name, amounts, and bank details. Multiply by a hundred clients and you hold a small financial archive. You are protecting their data as much as yours.
Does encryption protect me if my machine is hacked?
It protects data at rest, not in use. Malware running under your account can read what you can read. Encryption keeps a stolen device honest; it does not replace a clean system.
Do my backups need encryption too?
Yes. An encrypted database with a plaintext backup is a plaintext database. Encrypt the archive, or keep the backup drive offline at home.
Is my data still mine if LockMargin disappears?
Yes. The database is a standard SQLite file, and your exports are CSV and JSON. The encrypted database needs your passphrase; the plaintext exports do not. That is why open exports matter.
Is it illegal to store unencrypted client invoices?
In most places, no specific law says "encrypt." But data-protection rules such as GDPR require appropriate safeguards for personal data, and encryption is the standard example of one. Unencrypted is rarely illegal. It is rarely defensible either.
What is the best encryption for small business files?
AES-256 in a reputable tool: an encrypted SQLite database, a 7-Zip AES-256 archive, or an encrypted disk image. The algorithm matters less than the habits: a strong passphrase, encrypted backups, and keys you control.
About the Author
Vlad (Volodymyr) Shiyan — Founder & Developer, Kharkiv, Ukraine. Building LockMargin since December 2025. Offline-first invoicing for freelancers who are tired of subscriptions. Standard is $49 one-time. Read more about Vlad →
Ready to own your freelance data?
Own your tools for $49 once → Read the Manifesto →Get the Client Data Protection Checklist — PDF, no email required.
Not ready to own yet? Start is free — 5 clients, 5 projects a month, unlimited invoices.
No subscription · No account required · Your data stays yours forever