Your books hold sensitive information: bank transactions, customer and vendor details, and taxpayer ID numbers. This page describes how we protect it. It’s a summary, not a guarantee; no system is perfectly secure.
Encryption
- All traffic to Book Keeper uses HTTPS (TLS). Data is encrypted at rest by our database and storage provider.
- Social Security numbers and EINs get a second layer: they are encrypted with AES-256-GCM by the app before they reach the database, and decrypted only to show them to people allowed to see them or to print 1099s.
- Tokens for Stripe, Square, Mercury and QuickBooks connections are encrypted the same way.
Keeping companies apart
- Every company’s data is walled off by database rules (row-level security), so a signed-in person can reach only the companies they belong to. Automated tests check these rules on every change to the code.
- Roles (owner, admin, bookkeeper, viewer) limit what each person can see and change. Viewers can’t change anything.
Signing in
- Two-step verification with an authenticator app, with one-time recovery codes, is available to everyone. We strongly recommend it.
- Sign-in, sign-up and password reset are protected by reCAPTCHA and rate limits. Changing a password signs out every session.
- New public accounts must confirm their email address.
Payments and bank data
- Card and bank account numbers are entered on Stripe’s pages and stay with Stripe. They never reach our servers.
- Bank feeds are read-only. We never see or store your bank login.
Tracking every change
History records who changed what and when, for every record in your books, and lets you undo changes. The AI Assistant can only propose changes; a person approves them.
Backups and deletion
- We take an encrypted backup every night, keep each one for 7 days, and practice restoring them. Only Right Intent SI LLC holds the key.
- When you delete a company or account, it leaves our live systems after the grace period, backups age out within 7 days, and you get a certificate listing what was removed.
People and access
- Only a small number of authorized Right Intent SI LLC staff can access production systems.
- We look at a company’s books only when you ask for support, to keep the Service secure, or when the law requires it. Access to archived AI chats is logged.
- Our providers are listed on the Subprocessors page.
If something goes wrong
If we learn of a security breach that affects your personal information, we’ll investigate, contain it, and notify you and the authorities as the law requires, including Massachusetts’ data breach law, without unreasonable delay.
Reporting a vulnerability
Email support@igoquick.com with the details. Please give us a reasonable time to fix it before telling anyone else, and don’t access or change other people’s data. We won’t take legal action against good-faith research that follows these rules.