Protected connections
The public application and API use HTTPS. Sensitive integration tokens use authenticated AES-256-GCM encryption in the application.
AccountsOS / Security & privacy
Your books.
Your business.
Protected by design.
Financial data deserves clear boundaries. AccountsOS brings identity, company access and action controls together, with human responsibility built into the accounting workflow.
Explore the controlsIdentityAccess
AccountsOS
EncryptionRecoverySecurity / Across the workflowExplore below
01 / Access with boundaries
Know who has access.
Control what they can do.
Protection is built from several controls working together. Explore the checks around identity, company context and accounting actions.
Access architecture
Start with who is asking.
Authentication identifies the user. TOTP two-factor authentication adds another check at sign-in. API credentials are validated for expiry and revocation.
An explanation of the controls. This explorer does not change permissions.
Revocable API credentials
API key validation uses stored hashes. Keys are associated with a company and scopes, and can be revoked from Settings.
Access across a practice
Client allocation lets practices control which clients staff can work on, with separate owner and administrator roles.
02 / AI with responsibility
Intelligence needs context.
Access needs a purpose.
Finn uses business records and connected tools to do accounting work. Relevant data is processed by the services that make those capabilities possible.
01
Data and AI processing
AI providers process information for features such as conversations and document extraction. Our privacy policy and data processing agreement describe the processing arrangements.
02
Company memory
Saved company context helps Finn work with the nuances of a business. Memory and conversation history are part of the information AccountsOS holds to deliver the service.
03
Human sign-off
Finn prepares the work and surfaces exceptions. A person reviews and signs every filing. Designated actions have confirmation requirements.
03 / Resilience & ownership
Plan for recovery.
Keep a way out.
Backups support recovery. Export tools give you a copy of your records. Both are part of responsible financial software.
Backups beyond the primary server
Scheduled database backups are copied to separate cloud storage. The backup-writing credentials cannot overwrite or delete existing copies.
Recovery checks
Backup health monitoring checks freshness, while restore checks test that a backup can be read into a separate database.
Export your records
Download an account data export in Settings, or export individual financial reports. Account exports include document metadata; keep copies of the original files you need.
04 / Clear answers
Understand the details.
How do I manage access?
Use company membership and practice team settings to manage people. API keys have separate scopes and can be revoked in Settings. Enable two-factor authentication in your security settings.
What happens when I leave?
Export the records and documents you need before deleting an account. Deletion, retention and backup handling are covered by the data processing agreement and privacy policy. Contact us if you need help with a specific data request.
Can I ask about security or data processing?
Yes. Contact finn@accounts-os.com with your question. For a security report, describe the issue without including passwords, API keys or customer financial records.
Security / Open to questions