Security
Security is the product.
The security architecture, written for your IT and finance reviewers. Every statement on this page is auditable in the product.
Security architecture
Where data lives, moves, and gets processed
Users
Ops · Partner · Member
Web tier
Next.js portal + API
- Session auth, server-side authz
- Signed impersonation tokens
- No secrets in the browser
Data at rest · managed database
Postgres
RLS on every table · tenant scoping · AES-256 at rest
Storage
PDFs, statements, browser frames · signed expiring URLs
Credentials vault
AES-256-GCM envelopes · key IDs · rotation · tamper detection
Queue · Redis + BullMQ
Transactional outbox dispatch · transient job payloads · no secrets
Processing · isolated worker
- Credentials decrypted in memory only, per attempt - never persisted or logged
- Executes the pinned plan hash; effect policies enforced in code
- Writes evidence back: steps, immutable attempts, screenshots
Egress control
Pinned host allowlist · TLS required · same-origin redirects · DNS re-resolution · private networks & metadata endpoints blocked
Bexio · Zevvy · SolarManager · Google · PayPal · AI extraction · Email
Security model
Defense in depth - five enforced layers
Identity & tenancy
Organization memberships and customer access grants; row-level security scopes every table to the tenant.
Credential encryption
AES-256-GCM envelopes with key IDs, tamper detection, rotation. Secrets never in configs, logs, outputs, or screenshots.
Authorization
Server-side checks on every API and re-validation in the worker before each step - database, API, and runtime all enforce scope.
Runtime egress control
Outbound requests bounded: pinned hosts, TLS, same-origin redirects, DNS re-checks, private networks and metadata endpoints blocked.
Audit & impersonation
Every sensitive action is an audit event. Support impersonation is read-only, 15-minute signed, fully logged.
Provenance
Nothing mutates history - the pinning chain
Editing never rewrites
Changing a workflow creates a new draft and version. In-flight and historical runs keep executing exactly what they pinned.
Rotation never breaks
Credentials float to the current secret; the contract stays pinned. Rotating a password strands nothing.
Evidence is audit-grade
Approvals record a hash of the exact data reviewed, and failed attempts, retries, and reruns all stay in the record.
For customer IT
A one-pager for your IT review
Data residency
- Primary store: managed Postgres and object storage in a major cloud
- Region pinned per deployment - EU region available for Swiss / EU clients
- Web and worker tiers run on managed cloud platforms; region details confirmed in the DPA
Encryption
- TLS 1.2+ for all traffic in transit
- AES-256 at rest (managed by the database platform)
- AES-256-GCM envelope encryption for provider credentials - key IDs, rotation, tamper detection
- Files served via signed, expiring URLs; secrets never in logs, outputs, or screenshots
Subprocessors
- Core: managed web hosting, cloud database and storage, isolated worker runtime, email delivery, AI document extraction - each named in the DPA
- Customer-directed only when enabled: Bexio, Zevvy, SolarManager, Google Workspace, PayPal
- List maintained with change notice
DPA & compliance
- DPA available; GDPR and Swiss revFADP aligned
- Customer data is used only to deliver the service, not for training or benchmarking
- Breach notification without undue delay; data return / deletion on exit
Need it as a standalone PDF for an IT or procurement review? Request the one-pager
Safety by default
Built into the flow, not bolted on
Paused by default
Every new deployment starts paused. Nothing runs live until you activate it.
Zero-write test runs
Reads are real, writes are previews. Pilot a workflow without risking anything.
Approval gates
Humans approve before anything with money attached moves. Approvals record a hash of the exact data reviewed.
Immutable evidence
Every run pins the exact version it executed, and failed attempts, retries, and reruns stay in the record.