Security

We never hold your bank password

Bank connections go through Plaid. You sign in on Plaid's screen, and what comes back to us is permission to read transactions. We cannot move money, initiate a payment, or sign in as you at your bank — not because we promise not to, but because we do not hold anything that would let us.

One contractor cannot see another's books

Every table enforces the boundary in the database itself: a query can only return rows belonging to your own company. This is not a filter in application code that a bug could skip. Receipt images are scoped the same way.

Read-only really is read-only

An accountant invited to your books can see everything and change nothing, and that is enforced by database policy rather than by hiding buttons. A permission that lives only in the interface is not a permission.

Two-factor authentication

Turn it on in Settings, using any authenticator app. Given what is in here, a stolen password should not be enough on its own. You can also sign out every other device from the same screen — worth doing when a phone goes missing or somebody leaves.

Closed weeks cannot be edited

Once a week is closed the record is fixed, and the database grants no permission to change it — to you, to your team, or to us. That is what makes the history worth showing a lender.

What we would tell you

If your data were ever exposed, we would tell you what happened, what was affected and when, as soon as we understood it — not weeks later with a form letter.

Reporting something

If you find a security problem, tell us before telling anyone else and we will fix it quickly and credit you.