Security
Your books are the record of your business. Here is exactly how they are held, who can reach them, and what happens if something goes wrong. Nothing on this page is aspirational: if it is written here, it is true today.
Your data is separated by tenant, and the separation is enforced on the server
Every company belongs to an account, and every request is checked against the account it came from before a single row is read. It is not a filter the screen applies; it is a gate the server passes through, and the same gate runs whether the request came from a page, a report, an export or the phone.
Encrypted in transit and at rest
Every connection is HTTPS. The database and the file store both encrypt what they hold on disk.
Bank credentials are encrypted separately
The token that reads your bank is sealed with AES-256-GCM under a key derived for that purpose alone, and is unsealed only for the seconds a sync is running.
Social security numbers are never stored in the clear
Where the product holds an SSN for a tax form, it is encrypted with its own key and shown only to the one screen entitled to it.
Access is per person, per company, per level
Someone invited to one company sees that company. An accountant given read access cannot post. Every level is enforced server-side, not by hiding buttons.
Point-in-time backups
The database is continuously backed up and can be restored to a moment in time, which is the protection that matters when the problem is a mistake rather than a disaster. Your documents are copied out of the file store into the same backup, each one checked against its fingerprint. We also rehearse the disaster: on a schedule, a full copy of the database is restored from a backup and checked table by table, and every file the restored records point at is proven to be in the backup. In the last rehearsal the database restore took five minutes.
Changes are recorded
Posting, editing, voiding, deleting a document, granting access: each writes an audit record with who did it, when, and in which timezone the clock was reading.
We cannot read your password
Passwords are stored only as a bcrypt hash. Nobody here can look yours up, and a support request can never end with someone reading it back to you - the only route is a reset link to your own email.
What we do not claim
We are a small operation and we would rather be accurate than impressive. kBooks does not currently hold a SOC 2 report, an ISO 27001 certificate, or a completed penetration test. If your business requires one before you can buy, tell us and we will give you a straight answer about the timeline rather than a badge.
If you find a problem
Tell us before you tell anyone else and we will fix it and credit you. We do not threaten people who report security problems in good faith. Use the contact details on this page. We answer within one business day.
Who else can touch your data
These are every outside company involved in running kBooks. There are no others, and this list is maintained as part of the product rather than written once and forgotten.
| Company | What they do | What reaches them | Where |
|---|---|---|---|
| Neon | Database hosting | Your books: every transaction, invoice, document record and user account | United States |
| Vercel | Application hosting and file storage | The running application, and the document files you upload | United States |
| Resend | Email delivery | The name and email address of anyone you send an invoice, statement or invitation to, and the message itself | United States |
| Stripe | Card payments | Payment details of anyone paying you by card. Card numbers go to Stripe directly and are never stored by us | United States |
| SimpleFIN | Bank feed | Read-only transaction history from the bank accounts you connect, using an access token you obtain and control | United States |
Leaving, and taking everything with you
Any owner or admin can download the whole account at any time: every ledger line as a spreadsheet, a QuickBooks Desktop import file that rebuilds the company from nothing, and every document you filed. It works while an account is paid, unpaid, or closed - because it is a read, and reads never stop.