Security and data ownership

Your data is yours

You can export reports and documents at any time in PDF, Excel, CSV, HTML or JSON. Your records are not shared with other companies.

Separation between companies

Every company's rows carry its company id, and row-level security in the database lets a request see only the company it acts in. The API checks the company you name against your memberships and reads your role from the database, never from the request.

Money rules in the database

The database itself refuses unbalanced entries, changes to posted entries and documents, posting into locked periods, and approval by the person who made the entry.

Secrets

Passwords are stored as argon2id hashes. Refresh tokens, API keys and verification codes are stored only as SHA-256 hashes. Sign-in tokens last 15 minutes.

Integrations

API keys act as one person in one company, within scopes, and expire. Approving, posting and reversing money are never done through a key or through the assistant: a person confirms them in the app.

Public pages

The only public pages are this documentation and the document verification page, which shows only the facts needed to check a document.