Question 1

What security certifications and compliance standards does the platform meet?

Accepted Answer

Our platform runs entirely on SOC 2 Type II certified infrastructure: Vercel for hosting, Neon for our database, and Anthropic for AI processing. Each of these providers undergoes independent annual audits of their security controls, and we inherit those physical and infrastructure protections. On top of that foundation we implement our own application-level controls: TLS 1.3 encryption in transit, AES-256 encryption at rest, multi-factor authentication, and comprehensive audit logging. We are transparent about this distinction, and we are happy to walk through our security architecture in detail during your evaluation.

Question 2

How is financial data encrypted both in storage and during transmission?

Accepted Answer

Data at rest is encrypted using AES-256, the same encryption standard used by banks, covering all financial data and backups in our database. Data in transit is protected using TLS 1.3, the latest transport layer security protocol, and we enforce HTTPS connections with HTTP Strict Transport Security (HSTS). Sensitive authentication secrets, such as multi-factor authentication keys, receive an additional layer of AES-256-GCM encryption at the application level before they are stored.

Question 3

What access controls and authentication options are available?

Accepted Answer

Access is controlled through role-based permissions, so each user sees only what their role allows. Authentication uses email and password, strengthened by multi-factor authentication with time-based one-time passwords (TOTP) from any authenticator app, backed by encrypted single-use backup codes. Every successful and failed login attempt is recorded in the audit log.

Question 4

How are audit logs maintained and what activities are tracked?

Accepted Answer

Every user login (successful and failed), data access, report export, configuration change, and role change is logged with timestamps, user identification, IP addresses, and action details. Audit logs are retained for seven years by default to support compliance and long-term audit needs.

Question 5

How do you handle security for integrations with our accounting systems?

Accepted Answer

Accounting integrations use OAuth 2.0 authentication wherever supported, meaning we receive revocable authorization tokens rather than storing your actual credentials. We request the minimum permissions necessary, typically read-only access, and never have the ability to modify data in your source systems. All integration traffic is encrypted in transit, and data accessed through integrations is covered by our audit logging. You can revoke integration access at any time through our platform or directly through the connected service.

Question 6

Where is data stored and what happens to it if we leave?

Accepted Answer

Your data is stored in US-based data centers operated by our SOC 2 Type II certified infrastructure providers, with encryption at rest and continuous backups managed by our database provider. You can export your data in standard formats, and if you cancel the service we will delete your data from production systems on request.

Bank-Grade Security for Your Financial Data

Key Benefits

Bank-Grade Encryption

Multi-Factor Authentication

Comprehensive Audit Logs

Certified Infrastructure

Features

Encryption

Authentication

Audit Logs

Read-Only Integrations

Frequently Asked Questions