Question 1

What security certifications and compliance standards does the platform meet?

Accepted Answer

Our platform maintains SOC 2 Type II certification, which represents the gold standard for service organization security controls. This certification is issued by an independent auditing firm after rigorous examination of our security policies, procedures, and technical controls across five trust principles: security, availability, processing integrity, confidentiality, and privacy. We undergo annual SOC 2 audits with continuous monitoring throughout the year. Additionally, we comply with GDPR requirements for handling personal data of EU residents and CCPA requirements for California consumers. For clients in regulated industries, we can provide compliance documentation for HIPAA (healthcare), GLBA (financial services), and other industry-specific requirements. Our security questionnaire response package includes detailed documentation of our controls, policies, and compliance certifications to support your vendor assessment process.

Question 2

How is financial data encrypted both in storage and during transmission?

Accepted Answer

We employ defense-in-depth encryption across all layers of our platform. Data at rest is encrypted using AES-256, the same encryption standard used by banks and government agencies for classified information. This encryption applies to all financial data, documents, and backups stored in our systems. Data in transit is protected using TLS 1.3, the latest transport layer security protocol, ensuring that information moving between your systems and ours cannot be intercepted or read by unauthorized parties. Database encryption uses per-tenant keys managed through a hardware security module (HSM), ensuring that even in the unlikely event of unauthorized database access, data remains encrypted and unusable. Backup data is encrypted with separate keys and stored in geographically distributed locations. We regularly rotate encryption keys and maintain strict key management procedures audited as part of our SOC 2 certification.

Question 3

What access controls and authentication options are available?

Accepted Answer

Our platform provides comprehensive access control capabilities to match your organization's security requirements. Role-based access control (RBAC) lets you define exactly what each user can see and do—from full administrative access to read-only views of specific reports. You can create custom roles tailored to your organizational structure. For authentication, we support single sign-on (SSO) integration with major identity providers including Okta, Azure AD, Google Workspace, and OneLogin, allowing your team to use existing corporate credentials. Multi-factor authentication (MFA) can be required for all users or specific roles, adding a second verification step beyond passwords. We support authenticator apps, SMS codes, and hardware security keys. Session management includes configurable timeout periods, concurrent session limits, and the ability to remotely terminate sessions. IP allowlisting is available for organizations that want to restrict access to specific network ranges.

Question 4

How are audit logs maintained and what activities are tracked?

Accepted Answer

Our platform maintains comprehensive audit logs of all access and activities for security monitoring, compliance, and forensic purposes. Every user login (successful and failed), data access, report generation, configuration change, and administrative action is logged with timestamps, user identification, IP addresses, and action details. Audit logs are immutable—they cannot be modified or deleted, even by administrators—ensuring a trustworthy record for compliance and investigation purposes. Logs are retained for a minimum of seven years to meet regulatory requirements and support long-term audit needs. You can access audit reports through the platform showing who accessed what information and when, with filtering and search capabilities. For clients with security information and event management (SIEM) systems, we can stream audit events in real-time for centralized security monitoring. These audit capabilities are essential for demonstrating compliance with SOX, HIPAA, and other regulations that require access logging.

Question 5

Where is data stored and what disaster recovery capabilities exist?

Accepted Answer

Your financial data is stored in SOC 2 certified data centers operated by leading cloud infrastructure providers. By default, data resides in US-based data centers, though we can accommodate specific data residency requirements for clients with geographic constraints. Our infrastructure is designed for high availability with data replicated across multiple availability zones in real-time, ensuring no single point of failure. We maintain 99.99% uptime SLA backed by redundant systems and automatic failover. Disaster recovery capabilities include continuous backup with point-in-time recovery up to 30 days, geographically distributed backup storage, and documented recovery procedures tested quarterly. In a major disaster scenario, our recovery time objective (RTO) is four hours and recovery point objective (RPO) is one hour. We provide detailed information about our infrastructure and disaster recovery capabilities during the security assessment process.

Question 6

How do you handle security for integrations with our accounting and banking systems?

Accepted Answer

Integration security is a critical aspect of our architecture since we connect to sensitive financial systems. For accounting software integrations, we use OAuth 2.0 authentication wherever supported, meaning we receive authorization tokens rather than storing your actual credentials. These tokens provide limited, revocable access and don't expose your passwords. For banking integrations, we partner with established financial data aggregators who maintain their own SOC 2 certifications and bank-level security controls. We request the minimum permissions necessary—typically read-only access—and never have the ability to modify data in your source systems. All integration traffic is encrypted in transit and monitored for anomalies. Integration credentials are stored using envelope encryption with per-client keys. You can revoke integration access at any time through our platform or directly through the connected service. We maintain detailed logs of all data accessed through integrations for audit and compliance purposes.

Question 7

What happens to our data if we cancel or leave the service?

Accepted Answer

We have clear, documented procedures for data handling when client relationships end. Upon cancellation, you have 30 days to export all your data in standard formats (CSV, Excel, PDF for reports). We provide export tools and support to ensure you receive complete copies of all financial data, reports, and configurations. After the export period, we initiate a secure data deletion process: all your data is purged from production systems within 30 days of service termination. Backup data is purged according to our backup retention schedule, typically within 90 days. We provide written confirmation of data deletion upon request. During the transition period, your data remains protected by the same security controls as active accounts. For clients subject to data retention requirements, we can accommodate extended retention periods before deletion. Our data deletion procedures are audited as part of our SOC 2 certification to ensure proper execution.

Question 8

How do you monitor for and respond to security incidents?

Accepted Answer

We maintain a comprehensive security monitoring and incident response program. Our security operations team monitors systems 24/7 using automated threat detection, intrusion detection systems, and anomaly analysis. We employ multiple layers of monitoring including network traffic analysis, application-level logging, endpoint detection, and user behavior analytics. When potential security incidents are detected, our incident response process activates: immediate containment to limit impact, investigation to determine scope and cause, remediation to address vulnerabilities, and communication to affected parties as appropriate. We maintain relationships with cybersecurity firms for additional expertise during significant incidents. For incidents that may affect client data, we commit to notification within 72 hours as required by GDPR and sooner when possible. We conduct post-incident reviews and implement improvements to prevent recurrence. Our incident response procedures are documented, tested through tabletop exercises, and audited as part of our SOC 2 certification.

Enterprise-Grade Security & Compliance

Key Benefits

SOC 2 Type II

Bank-Grade Encryption

Access Controls

Data Residency

Features

Encryption

Authentication

Audit Logs

Compliance

Frequently Asked Questions