Security and data

Where your data lives

All customer data is stored in the European Union, in Frankfurt, with encrypted backups in Dublin. Nothing is stored outside the EU.

Access

Two-factor authentication is available to every user and required for Practice plan administrators. Sessions expire after 12 hours of inactivity. Bank connections are read-only; we can never move money.

Your data is yours

Export everything as CSV or a full JSON archive at any time from Settings, on every plan including the trial. If you cancel, the export stays available for 90 days.

Compliance

We are a registered data processor under GDPR and offer a data processing agreement on request. We are not yet ISO 27001 certified; our security practices are documented for customers who ask.

Uptime

We publish our uptime on a public status page. We do not offer a contractual SLA on Solo or Team; Practice plan customers can request one.