Security
Security facts, not adjectives
Your books are the most sensitive data your company owns. This page says exactly what we do — and what we don't do yet.
At a glance
| Area | What we do |
|---|---|
| Document encryption | Each company's documents are encrypted with their own key (AES-256-GCM) and stored by content hash. |
| AI | Your data is never used to train shared AI models. |
| Access to your Google account | Read-only Gmail and Drive access. We cannot send, delete or move anything. Disconnect any time. |
| Bank access | None. We don't ask for bank logins. You upload statements. |
| Approvals | AI only drafts. Nothing reaches your books without a person's approval. |
| Audit trail | Every draft, approval and edit is written to a hash-chained log, sealed daily. It can't be switched off. |
| Your exit | Export everything any time in standard formats. If we shut down: 90 days' notice and a full export. |
Compliance
- Companies Act audit trail: BoringAccounts records an unalterable trail of changes, supporting Rule 3(1) of the Companies (Accounts) Rules.
- DPDP Act 2023: for your company's books we act as a data processor on your behalf.
- Certifications: BoringAccounts is not yet SOC 2 or ISO 27001 certified.
Report a vulnerability
Email security@boringaccounts.com. We reply within 2 working days. Please don't access data that isn't yours.
Questions
What happens to files uploaded to the free tools?
They are read in your browser and never uploaded to us.
Do you sell or share data?
No.
Last updated: