Controls an auditor would sign off
Access is checked on every request, every change is recorded, and the books cannot be bent. Here is how.
Role-based access with record scope
19 ready-made roles and five scope levels — own, team, department, branch, company — checked on every query.
Every route gated, enforced in CI
More than 2,500 API routes carry a permission check; the few public ones (sign-in, careers, signed webhooks) are listed with a reason. The build fails if a route ships without one.
Strong sign-in
TOTP multi-factor and passkeys, SSO over OIDC or SAML with SCIM provisioning, IP allow-lists, rotating refresh tokens in httpOnly cookies, session revocation and rate-limited logins.
Field-level security
Cost prices, margins, salaries and bank details are stripped for users without the matching permission.
Complete audit trail
Creates, edits, approvals, postings and cancellations are recorded with who, when, and old and new values.
Accounting integrity
Debits must equal credits, posted documents are immutable, closed periods reject postings and numbering is gap-free.
Encrypted secrets
Provider API keys and integration secrets are encrypted at rest; webhooks are HMAC-signed.
AI privacy controls
Strict and Air-gapped modes limit eligible models; PII redaction covers supported text requests. Document images sent for extraction are not redacted, so use an approved zero-retention or self-hosted vision model for sensitive files.
Safe integrations
Idempotency keys on critical writes, a transactional outbox for events, and per-key API access.
Security work on the roadmap
What we have not shipped yet — so you can plan with the facts.
- Alerting on top of the built-in metrics and tracing
- Point-in-time database restore (daily backups ship today)
Need our security answers for your review?
Tell us what your security questionnaire asks and we will walk your team through it.