Your data is fenced at the database, not in the code
Separation between organizations is enforced by the database itself, underneath the application — so a mistake in our own code cannot read across organizations.
Built for small business
Built to be checked, not trusted
Security claims are easy to write. These are the ones we can show you.
Support cannot look without your consent
A support engineer needs a time-boxed grant that you approve, and every entry is recorded on your own support access log.
The audit trail cannot be edited
Records are hash-chained and append-only; the chain can be verified from inside the app.
Sensitive actions ask again
Changing roles, moving money, or exporting data asks again for your passkey, bound to the exact change being made.
Your data leaves when you ask it to
Full data export in an open format, and erasure that reaches backups on a published schedule.
Talk to us
Questions about fit, migration, or pricing — write and a person will answer. If you are signed in, we will see which user account wrote and reply there.