Security & data handling

Read-only by design. This tool never connects to a bank or an accounting system and never changes a financial record. It works only on the CSV files you upload.

Your data stays yours. Uploaded files are stored unmodified (SHA-256 recorded at upload), every account's data is isolated from every other account, and exports are generated only for the account that owns the run. Passwords are stored as salted PBKDF2 hashes; sessions are stored hashed and expire after 30 days.

Encryption. Data is encrypted in transit (TLS) when served from the production host. Encryption at rest is provided by the hosting platform's storage.

Subprocessors. Hosting: Oracle Cloud Infrastructure. Payments: Stripe (card data goes to Stripe, never to this app).

Retention & deletion. Run evidence is kept so your workpapers remain reproducible. You may request deletion of your account and data at any time from the Account page; deletion is completed within 30 days, including backup purge within 35 days, and a full export of your data is offered before deletion.

Breach notification. If a breach affecting your data is confirmed, we will notify affected account holders without undue delay. A data-processing agreement is available on request.

What we do not claim. No SOC 2 or similar certification is claimed. Reports produced by this tool state what matched under the stated rules — they are not certifications that books are correct.