Security
Your books hold some of the most sensitive information a business has. This page describes how BooksBat protects it and how to report a security problem to us.
Encryption
All traffic uses TLS (HTTPS), with HSTS so browsers never fall back to plain HTTP. Data is encrypted at rest by our database and file storage providers. Credentials for your payment providers, stores and bank connections are encrypted again with a separate application key before they are stored.
Sign in protection
Passwords are stored as salted, slow hashes and never in readable form. Two factor authentication adds a code from an authenticator app at sign in. Sign in attempts are rate limited per network and per account, and sessions use secure, HTTP only cookies.
Access controls
Every request is scoped to one company. Team members get role based permissions (for example reports only, sales only, expenses only, accountant or admin), so each person sees and changes only the areas you allow. API keys act with the role of the person who created them and can be revoked at any time.
Audit log
Every create, change and delete in your books is written to an audit log with who did it and when, with the values before and after. A closing date with its own password protects finished periods from changes.
Application security
A strict Content Security Policy, protection against cross site request forgery, input validation, upload checks and sanitising of images and templates, and isolated rendering of documents. Public invoice, quote and document links use long random tokens and are kept out of search engines.
Infrastructure and backups
The service runs on managed hosting (Fly.io), a managed database (MongoDB Atlas) and object storage (Cloudflare R2), with automated backups for disaster recovery. Staff access to production is limited to the people who need it and is logged. You can export your data whenever you like.
Privacy by design
No advertising trackers. Analytics load only after you accept them and never on the pages your customers see. Financial data is never sent to analytics. AI features are optional and receive only what a request needs. See the Privacy Policy.
Incidents
We monitor errors and unusual activity. If a breach affects your data we will tell you without undue delay, with what happened and what we are doing about it, and notify authorities where the law requires.
Report a vulnerability
If you believe you have found a security problem, please email [email protected] with the steps to reproduce it. We will acknowledge your report within 3 business days and keep you updated until it is fixed. Our security.txt has the same contact.
While you investigate, please only use accounts you own or have permission to test, do not access, change or delete other people’s data, avoid degrading the service (no denial of service or automated scanning at volume), and give us reasonable time to fix the problem before you disclose it. We will not take legal action against research done in good faith under these rules.
Contact
BooksBat: [email protected]