Security & trust
How we handle your data and access
Straightforward answers about authentication, encryption, backups, and what to expect from the product.
Authentication and access
- Credentials (email/password) with optional MFA. MFA secrets are stored encrypted.
- Session-based access with configurable expiry. No long-lived API keys for normal users.
- All app actions are scoped to the authenticated user and their businesses; no cross-tenant access.
- Rate limiting and brute-force protection on login and sensitive endpoints.
Data handling and encryption
- Sensitive fields (e.g. passphrase-derived data) can be encrypted client-side; keys are not sent to the server.
- Server-side encryption and hashing where applicable (e.g. password hashes, MFA secrets).
- Data is stored in a database you control (or your host’s); we don’t sell or share your data.
- Traffic over HTTPS; secure headers (CSP, HSTS, etc.) where configured.
Backup and export
- You can export data (CSV, backup packages) from the app for your own backups or migration.
- No lock-in: your books are yours. Export and take them to an accountant or another system.
- Operational backups depend on your deployment (e.g. database backups on your host).
Operational expectations
- Uptime and reliability depend on your hosting (e.g. Vercel, your own Docker setup).
- We don’t guarantee specific SLAs unless you have a separate agreement.
- Security issues: report them responsibly; we take them seriously and will address critical issues promptly.
Questions about security or compliance? Reach out before you commit.