Security overview

A plain-English summary of how eCashbook protects your data. (This page describes measures; it is informational and doesn't replace the DPA.)

Tenant isolation

Every practice (organisation) is a separate tenant. Isolation is enforced in the database itself with row-level security — a signed-in user can only ever reach rows belonging to their own organisation, and a portal client only the specific business they've been linked to. One practice can never see another's clients, rules or learned memory.

Encryption

• In transit: all traffic is HTTPS/TLS, including client upload links.
• At rest: the database and file storage are encrypted at rest by our hosting provider (Supabase).

Access control

• Practice staff sign in with individual accounts; team members are invited per practice with revocable access.
• Client uploads work through unique tokenised links — clients never get database access.
• Documents are held in private storage and served only via short-lived signed URLs.

Integrity of the books

• Audit trail — posting, unposting, locking and deletions are recorded with who did what and when.
• Period locking — filed periods can be locked so nothing inside them can be changed without an explicit unlock.
• Reconciliation checks — imported statements are verified against opening/closing balances.

AI data handling

PDF statements and transaction descriptions may be processed by Anthropic (and Google Document AI) to extract and categorise transactions. Under our provider agreements this content is not used to train models, and AI output is always reviewed by a human before posting (unless the customer has explicitly enabled auto-posting for a known payee).

Infrastructure and backups

• Application hosted on Vercel; data on Supabase (Ireland (AWS eu-west-1)).
• Automated daily backups with provider-managed retention; point-in-time recovery as provided by the hosting plan.
• Secrets (API keys) are held server-side as environment variables — never in the browser.

Reporting a vulnerability

If you believe you've found a security issue, please email info@finnacc.com with details. We ask for reasonable time to investigate and fix before public disclosure, and we won't pursue good-faith research conducted within the law.