Security

There are no passwords to leak. You sign in with a six-digit code sent to your email address.

• A code works once and for ten minutes, and stops working after a few wrong tries. It is stored only as a keyed hash.
• A browser stays signed in with a cookie that scripts cannot read, and that is only sent over a secure connection. The service stores only a hash of the cookie's value.
• Asking for a code gives the same answer for every address, so it cannot be used to find out who has an account.
• You can sign out of every browser at once from the account page.

• Every record belongs to one account, and every request is limited to the account of the person asking.
• Asking for another account's record gets the same answer as asking for one that does not exist.
• The tests check this for every route that works on a company, read from the route table so a new route is included.

• Entries in the books are never edited or deleted, and every change is logged.
• A filing pack's content cannot be changed once it is made, and its status only moves forward: the database refuses anything else.
• Secrets the service has to keep, such as saved access to another service, are sealed before they are stored.
• The pages load nothing from anywhere else: no third-party scripts, and no advertising or analytics.
• A browser request that changes something is refused if it came from another site, and the number of requests anybody can make is limited.

The service runs on Cloudflare: its Workers, database and file storage. Transaction descriptions are sent to an AI model through Cloudflare's AI Gateway to suggest categories. Logging of what is sent is switched off unless somebody turns it on to find a fault.

• No independent security audit or penetration test has been done yet, and the service holds no security certification.
• Nobody outside the project has reviewed the calculations or the filings.

To report a problem, write to the address on the privacy page.