Security

Your clients send us bank statements and payroll reports. This page explains, in plain terms, how we handle them. Questions: hello@localhost.

Storage and encryption

• Files are stored in private object storage (Cloudflare R2). There are no public file URLs.
• Data is encrypted in transit (TLS) and at rest by the storage and database providers.
• Magic-link tokens and two-factor secrets are stored encrypted. Links are looked up by a one-way hash.

Access

• Firm users sign in with a password and can turn on two-factor authentication with an authenticator app.
• Every query is scoped to your firm. Other firms cannot see your clients, requests or files.
• Client upload links only show that client's checklist, expire after 45 days, and stop working when you archive the request.
• File downloads go through your signed-in session and are recorded in the audit log.

Uploads

• Only document types (PDF, images, CSV and spreadsheets) up to 20 MB are accepted.
• Every file is scanned for malware with ClamAV before it is checked or shown to you. Infected files are deleted immediately.

Automatic checks

• To check a statement we send its text (or, for scans, the image) to an AI model provider under terms that do not allow training on the data.
• We keep only the fields we need: document type, account last 4 digits, statement period, opening and closing balance, and page count. Prompts and full text are not stored.

Retention and deletion

• You choose how long files are kept after you download them (default 30 days). After that they are deleted from storage automatically.
• The firm owner can delete the firm from Settings. Client links stop working immediately, files are deleted from storage within minutes, and all other firm data is removed at the same time. Encrypted database backups that may still contain it expire within 30 days.

Audit log

• Uploads, downloads, approvals, rejections, emails sent and plan changes are logged with time, user and IP address.

Subprocessors

• Hosting: Laravel Forge on a cloud server provider. Database: PostgreSQL on the same provider.
• File storage: Cloudflare R2. Email: Postmark. Error monitoring: Sentry. Payments: Dodo Payments (merchant of record).
• AI model provider for statement checks (named in the data processing agreement).

Reporting a vulnerability

Email us with details. We reply within 2 business days and won't take action against good-faith research.

See also our data processing agreement.