Security

Accta handles your business's money data, so it is built to need as little access as possible and to keep what it has protected. We don't hold any security certifications yet, and we don't claim to.

Read-only by design

• Accta asks connected tools for read-only access only. It cannot move money, pay bills or change your books.
• Stripe is connected with a restricted key that you create with read permissions only.
• Google Calendar uses the read-only calendar permission.

Protecting data

• All traffic to accta.si and app.accta.si is encrypted (HTTPS), and browsers are told to always use it.
• Access tokens and keys for connected tools are encrypted by Accta before they are stored, with keys that can be rotated.
• Your data sits in a database that is reachable only by Accta's server, not directly from the internet or the browser.
• Every business's data is kept apart, and each request is checked against the signed-in owner.

You stay in charge

• Nothing goes to a customer without your approval unless you switch on autopilot for that customer, and final notices always ask.
• Every reminder that goes out is logged with who approved it and when.
• Disconnect any tool, or delete your data, at any time.

Reporting a problem

If you think you've found a security issue, write to hello@accta.si. Please give us a chance to fix it before telling others.