Your data

These are your clients' books. Here's how they're looked after.

Your bills, your bank statements, the numbers you'll be signing off. Here's how they're kept — in plain terms, no badges, no wall of logos. Everything on this page is built and running today. Where we haven't got something, we've said so rather than left you to assume.

Keeping clients apart

Nothing wanders between businesses.

If you're doing the books for a dozen companies, this is the one that keeps you awake. Every document here belongs to exactly one business — and there's no path from one to another.

One document, one business

Nothing sits in a shared pile. Someone who works on one client only ever sees that one — not a filtered view of everything, but genuinely only that one.

What we learn from your paperwork stays yours

Your suppliers, your numbers, the corrections you made last Tuesday. None of it makes its way into another customer's account, and none of it is shared out.

“That doesn't exist”

If someone goes looking for another client's paperwork, they're told there's nothing there — not that they're not allowed it. “You can't have that” would confirm it exists. So we don't say it.

Who can do what

Read-only means read-only.

Not a note in a policy that everyone agrees to and nobody reads. A person who's been given a look at the books simply cannot do the other things — the buttons aren't there and the door isn't there either.

Someone can review without changing a thing
Hand a junior, an auditor or a client's own accountant a view of the books, and that's all it is. They can't edit a number and they can't quietly become able to.
And can't change where your data gets sent
The delivery side is separate from the reading side. Being able to look at a bill has never been the same thing as being able to redirect one.
A read-only person can't cut new keys either
No quietly minting a key to your account that then does the things they couldn't. The back door is shut for the same people as the front one.
Logging out really logs you out
Access ends the moment you log out — not whenever a timer happens to run down. If a laptop goes missing on the train, that's the difference that matters.
Secrets

We can't show you your own password back.

Not won't. Can't. It isn't kept in a form anyone can read — and that includes us, and it includes anyone who ever gets hold of the database.

Your password
There's nothing to read back. If someone walked off with the lot tomorrow, they'd have a pile of nonsense and no way to turn it back.
The keys to your own systems
The password that lets us drop a file on your server is kept scrambled too. Set it, replace it, remove it — but nobody can look at it. All you'll ever see is that one is set.
A key to our system is shown once
When you make it, and that's the only time. After that even we only hold a scrambled version — so “can you email me that key again?” has one honest answer, and it's no.
Turn a key off and it's off
Not at the end of the hour, not in five minutes. The very next time someone tries it, it doesn't work.
Your documents' front door

Your own address — and it's fussy about who it lets in.

Documents arrive by email, which means the address itself is a way in. So it's built like a door, not a letterbox.

Nobody can guess their way in

Address

You get your own address for documents. Mail to an address that doesn't exist here quietly stops.

  • It never bounces back a clue — no “no such user”, no hint that you were close
  • Which means there's nothing to guess against, and no way to work out someone else's address by trying

Is this bill really from who it says?

Sender

We work out whether a message genuinely came from the supplier on it, rather than someone with a convincing signature block.

  • Including when it's been forwarded on to you — which is the check most systems lose the moment an email is passed along
  • That matters, because forwarding is exactly how a bill reaches you in real life

You say who's allowed

Rules

Name the senders you'll accept documents from, and that's the list. Everything else is somebody else's problem.

  • The same document sent twice is only ever handled once
  • So a forwarded chain, or an eager supplier, doesn't turn into a duplicate in your books

The thread through all of it: when in doubt, do nothing rather than something wrong. It's the same instinct that makes a rule stop rather than guess.

The unusual one

The locks get checked every time we ship. Automatically.

Every serious leak you've read about was the same story underneath: one door somebody forgot to lock. Not a clever attack — a forgotten door.

So we stopped relying on remembering. Every time we go to release an update, our own system walks through every single door in the software and checks each one is locked. If one isn't, the release stops.

There are exactly four ways into the system that don't need a login, and they're on a list. Add a fifth by accident on a Friday afternoon and the release fails on the spot. Nobody has to notice. Nobody has to be having a good day.

It isn't a promise, and it isn't a policy document. It's a machine that refuses.

Checking the doors Release blocked
DoorLocked?
Look at a documentYes
Change where files are sentYes
Cut a new keyYes
Something added this morningNo
One door open. Nothing ships. This is what you want to happen.

Four ways in without a login. On a list. Counted every time.

The record, and the rubbish bin

What's written down, and what's genuinely gone.

Two questions that get asked eventually: “who did this, and when?” and “is that actually deleted?” Both have straight answers.

A record of everything

Every login, every change, every document that moved — with a name and a time against it. And it's kept in a way that survives even when something goes wrong mid-way, which is precisely the moment you'll want to read it.

Delete means destroyed

Delete a document and the original PDF is genuinely destroyed, and the numbers read off it are wiped. Not hidden from a list. Gone.

Except the fact that it existed

What stays behind is the note that a document was here and what it cost you. Deliberately — so your billing adds up and your audit trail doesn't develop holes exactly where someone tidied up.

Your call

You decide what's worth reading.

Turn processing off and documents still arrive and sit safely, costing nothing, until you say go. Useful when you're not sure yet, or when a batch turns up that you'd rather look at first.

Nothing here starts reading your paperwork because it was left switched on by default.

Arrives Supplier invoiceandBank statement
Reading Off
So Held safely. Nothing charged.

Turn it on whenever. The pile is still there.

The honest bit

We haven't got a wall of badges.

You've seen the page we're not showing you — the row of logos, the seals, the acronyms in neat grey boxes. We haven't got those. What we've got is everything above, which is the actual list, written out, in words you can hold us to.

We'd rather tell you exactly what's true than show you a logo. If there's something on this page you want to poke at, ask — we'd honestly rather you did. And if there's something you need that isn't here, we'll tell you it isn't here.

Ask us the awkward questions.

Bring the list your IT person gave you, or just the one thing that's been bothering you. We'll go through it, and where the answer is “no, we don't do that”, you'll get that too.