Trust
Built so it cannot lie to you
Trust is not a promise on a slide. It is enforced in the database, in the audit chain and in the export button. This page says what is live today and what is designed, plainly.
The journal
The journal cannot lie
The books are append-only. Nothing is ever edited or deleted; a correction is a new reversing entry, so every number keeps its full history.
Balance is not a convention we follow. The database itself refuses any entry whose debits and credits disagree and blocks writes into locked periods. Even our own code cannot break the books.
The audit log
Every action leaves a chain
Every service writes to one append-only audit log and every record is hash-chained to the one before it. Tampering with any record breaks every hash after it, so the log is tamper-evident by construction.
App, worker and API all write to the same chain. Nothing bypasses it.
Masking
What AI never sees
Names, phone numbers, tax ids and account numbers are replaced with placeholders before anything reaches a model. The model drafts against the masked text; your real details are restored only inside your own books.
Model providers never retain your data and it is never used for training. The AI only drafts and explains. Deterministic math does the accounting.
Export
Your data leaves with you
One click exports the full ledger, your documents and the audit history. It works on every plan, any day, with no fee and no waiting period.
Lock-in is not a retention strategy we are willing to use. If we ever stop deserving your books, you take them.
Keys and encryption
Where encryption stands today
Live today: all traffic runs over TLS and stored data is encrypted at rest by our database and storage providers.
Live today: the org-key envelope itself. Each organisation has its own data encryption key. The classified fields are encrypted under it before they reach the database: contact phone numbers, email addresses, tax identifiers, connector refresh tokens and every document in the vault. A leaked table shows ciphertext where those values used to be. Rows written before the key existed still read. They re-encrypt the next time they are saved, so nothing had to be migrated in one risky pass.
Still on the road map: the master key that wraps those org keys lives in an environment secret today, not yet in a managed key service. Owner-triggered key rotation is designed but not built. Until the managed key service lands, the product runs on fixture and founder-created data only.
We would rather tell you exactly where the line is than round up.
Encrypted with your organisation's own key · never used to train AI · never retained by a model provider · exportable in full, any day · reviewed by a human accountant.