Bookkeeping data is sensitive and boring, which is the right combination for careful engineering.
Held in the United Kingdom, encrypted at rest and in transit. Backups every hour, kept for 35 days, tested monthly by restore.
Bank connections are read-only, through regulated open banking providers. Staff cannot see customer books without a support ticket that the customer opened, and every such access is logged and visible to the customer.
Two-factor authentication on every plan. Sessions expire after twelve hours of inactivity. The audit trail records who changed what, when, and from where.
Write to security at the company domain. We reply within one working day and pay for well-documented findings.