You own the data you enter
Your ledgers, customers, suppliers, stock, employees and documents belong to your business. We hold them to run the service for you, and for no other purpose.
Security & data
Security, privacy and who owns your data
Your accounting system holds your customer list, your margins, your payroll and your tax position. This page describes the controls that protect it, in enough detail to be checked — and is explicit about the questions we answer in writing rather than on a web page.
Every control below can be demonstrated in a live system during your evaluation.
Ownership
Your records are yours
This is the first thing to settle with any cloud vendor, because everything else depends on it.
You can get it out at any time
Reports export to Excel and PDF (CSV in the hotel and restaurant reports), and you can take a backup and download it, without a paid extra or a support request. You are never holding your own history hostage to a subscription.
We do not trade on it
The business records inside a customer’s workspace are not used for advertising, not resold, and not used to build products for anyone else.
Your workspace is separate
Each company’s data is held in its own database, separate from every other customer’s, with its own sign-in address.
You can see what was done to it
The activity log records who saved, edited, approved and deleted documents, with the module and the time, and can be filtered by user and printed.
You can leave with it
If your subscription ends there is an agreed wind-down period in which you export your records. The terms of that are set out in the service agreement, not decided at the time.
Access
Who can get in, and what they can reach
Most real-world losses are not sophisticated attacks. They are an ex-employee whose login still worked, or a member of staff who could reach something they should never have been able to reach.
Getting in
- Accounts lock after repeated wrong passwords
- Optional sign-in from listed office IP addresses, with a per-user exception where someone genuinely needs to work from elsewhere
- Account start and expiry dates, so seasonal and temporary staff lose access automatically rather than when someone remembers
- Accounts can be suspended immediately without deleting the person’s history
What they can do once in
- Granular role-based permissions, assigned by job rather than by person
- Navigation follows the role, so people are not shown work they cannot perform
- Approval before purchases, receipts, payments, journals and notes reach the books
- Users work in the branches they are given; lists open on their branch
- An activity log of user actions, filterable by user, module and date
Least privilege is worth the setup time. The most common configuration mistake we see is one powerful role shared by everyone, because it was quicker on day one. We will push back on that during implementation — segregation of duties is the control auditors test first.
Integrity
How changes to the numbers are controlled
Security is usually discussed as keeping people out. For an accounting system the harder problem is controlling how what is inside can be changed, and by whom.
IRD invoices cannot be changed
With IRD on, a saved invoice has no Edit or Delete; it is corrected by a return or a same-day cancel.
Corrections leave a trail
Other documents can be edited until they are approved, reconciled or their year is locked. After that a mistake is fixed with a credit note, debit note or new voucher that references the original document, and the activity log records the user.
A hotel retry cannot duplicate a posting
Hotel check-out and night-audit postings carry a retry key, so a retry gives back the same invoice and never posts a room night twice.
Setup is checked first
The hotel and the till check their setup before they let you trade, and name what is missing.
Many totals are traceable
Many reports open the documents behind their figures, which is what makes an audit a review rather than a reconstruction.
Backups you can take and download
You can take a backup and download it at any time. Restores are run with Penahak support.
Deliberately not on this page
The questions we answer in writing, not in marketing copy
Security pages are full of phrases like "bank-grade encryption" and "99.9% uptime" that mean nothing without the detail behind them. We would rather answer these properly, to your procurement team, in a document we can be held to.
- Where data is hosted, and under whose jurisdiction
- Encryption in transit and at rest, stated precisely
- Backup frequency, retention periods and tested recovery objectives
- Availability commitments and how they are measured
- Incident response and breach notification process
- Sub-processors and third parties with any access
- Staff access to customer data, and how it is controlled and logged
- Independent testing or certification, and its scope
- Data deletion on exit, and what we are legally required to retain
A note on how to read any vendor’s security page. If a claim has no scope, no date and no way to verify it, it is decoration. Ask for the questionnaire, ask who signed it, and ask when it was last reviewed — of us and of everyone else you are considering.
Bring your security review to us
If your organisation has a vendor assessment process, send it. We would rather work through your questionnaire than have you infer answers from a web page.
Procurement and IT questions are answered by the team responsible, not by sales.