Skip to content
Pocket-CFO docs

Security and trust

How Pocket-CFO protects your financial data: we only read from your accounting system, every sign-in needs two-factor authentication, each tenant is isolated in the database, and the AI never calculates a number.

We only read your books

Pocket-CFO reads from your accounting system and never writes to it. No connector creates, edits, or deletes a journal entry, invoice, or bill in QuickBooks, Xero, Sage Intacct, Zoho Books, FreshBooks, or Wave. Whatever happens in Pocket-CFO, your ledger is exactly as you left it.

The credentials that let us read your books are encrypted with AES-256-GCM before they are stored. When you disconnect a connection, we delete our stored copy. To withdraw access completely, also remove Pocket-CFO from the connected-apps settings in your accounting system.

Two-factor authentication, always

Every account uses two-factor authentication with an authenticator app, and every request for your data requires a session that has completed it. There is no way to reach financial data with a password alone — the same rule applies to client-portal viewers, and the database itself enforces it as well as the application.

When you set up two-factor authentication you can generate ten recovery codes. We store only a one-way hash of each code, so we can’t read them back to you, and each code works once. See Set up two-factor authentication.

Your data is isolated

Every organization’s data is separated from every other organization’s in the database itself, using Postgres row-level security. Signed-in requests run under a database role that is not permitted to bypass those rules, so the isolation doesn’t depend on every line of application code getting a filter right — and an automated test checks that every table carries its policy.

Inside an organization, access is narrowed further: in an advisory firm, an analyst sees only the clients assigned to them. See Roles and permissions.

How AI is used — and where it isn’t

The AI never does the maths. Every figure you see — revenue, margin, burn, runway, tax estimates — is calculated by Pocket-CFO’s own backend code, in whole cents and basis points, the same way every time. The same books always produce the same numbers.

AI is used only to put those numbers into plain English: KPI briefs, the CFO diary, and answers from Ask Pocket-CFO. The model is given derived summaries of figures that have already been calculated — never raw ledger rows, and never your credentials. A KPI brief may only cite facts it was given; if it tries to cite anything else, it is discarded and a brief written without AI is saved instead.

AI-written text is informational. It is not financial, tax, or legal advice; review decisions with a qualified professional.

An audit trail of sensitive actions

Sensitive actions are recorded with who did them, when, and from which IP address and browser: changes to roles and membership, invitations, connecting and disconnecting an accounting system, exporting a PDF, emailing a brief, using a recovery code, and deleting an account. The log is append-only — the database refuses to modify or delete its entries.

Protections in the platform

  • All traffic is encrypted in transit over HTTPS, with HSTS.
  • The app can’t be embedded in another site’s frame, which blocks clickjacking.
  • Requests are rate-limited, both overall and per feature.
  • Secrets are removed from application logs.
  • Code changes are checked automatically for leaked secrets, vulnerable dependencies, and common security flaws.

Deleting your account

If you are the only member or the last owner of an organization, deleting your account cancels its subscription, deletes its stored accounting credentials, deletes the organization and its financial data, and then deletes your login. If others remain in the organization, only your membership is removed. See the Data Deletion Policy.

Policies and subprocessors

The full legal terms live in the app:

Privacy questions: privacy@rippre.com.