Security

1. Overview

We use reasonable technical and organizational measures designed to protect customer data. No system can be guaranteed to be completely secure. This page describes what we do today and is deliberately honest about current limitations, so accountants and their clients can make an informed decision. It is not a certification and does not claim one.

2. Hosting and infrastructure

Accordix runs on Render, a managed cloud platform, in the European Union (Frankfurt, Germany), using a managed PostgreSQL database and a persistent disk for uploaded files. We rely on the hosting provider for physical and infrastructure security.

3. Encryption in transit

All traffic to and from the Service is encrypted using HTTPS/TLS.

4. Encryption at rest

We do not currently implement application-level encryption at rest. Data is stored on the hosting provider's managed database and disk, which provide their own infrastructure-level protections. We do not claim application-managed encryption of files or database fields.

5. Access control

Access to the Service requires authentication. Passwords are stored only as salted hashes (bcrypt); we never store them in plain text. Sessions use a signed, httponly cookie. Internal access to production systems is limited to the people who need it.

6. Tenant separation

Each organization's data is logically separated. Application queries are scoped to the signed-in user's organization, and role-based access controls distinguish business members, accountants, and operators, so users see only the data they are permitted to access.

7. Audit logs

We record audit information for inbound document intake channels (email and WhatsApp intake). We do not currently maintain a full end-user audit trail for in-app document upload, download, or deletion actions. Expanding audit coverage is a planned improvement.

8. Backups

The managed database and storage are backed up by the hosting provider. Backups are rotated in the ordinary course, with residual copies overwritten within approximately 35 days.

9. Monitoring and incident response

We monitor the Service for errors and operational issues and follow an internal breach response procedure if a security or personal-data incident occurs. If a personal data breach affects customer data, we will notify affected customers without undue delay as described in the Data Processing Agreement.

10. Secure development practices

We follow standard practices including code review, dependency management, and avoiding the logging of sensitive data — document contents, recipient email addresses, secrets, tokens, and download links are deliberately kept out of logs.

11. Support access

Support personnel access customer data only when necessary to operate the Service or respond to a request, on a need-to-know basis. The Service does not provide a support "log in as customer" impersonation feature.

12. Data export and deletion

Customers can request export and deletion of their data as described on the Data Export & Deletion page.

13. Responsible disclosure

If you believe you have found a security vulnerability, please contact security@accordix.sk. We ask that you give us a reasonable opportunity to investigate and address the issue before public disclosure, and that you avoid accessing or modifying other users' data during testing.

14. Limitations (current)

To remain honest, the following are not in place today and should not be assumed:

• no application-level encryption at rest (see section 4);
• no multi-factor authentication;
• no self-service password reset;
• no rate limiting on the login endpoint (only a short throttle on re-sending verification emails);
• download links are protected by a permission check but are not signed or time-limited;
• audit logging covers inbound intake channels only (see section 7);
• no SOC 2, ISO 27001, penetration-test certification, certified archiving, or end-to-end/client-side encryption is claimed.

These are tracked internally as planned improvements.