Finacra

Security

Last updated 25 June 2026

Finacra processes books-level data for SMBs and CA firms — bank lines, invoices, payroll, statutory identifiers. Treating that data carefully is the product, not a checkbox. This page documents what we actually do. Reach ibrahim@finacra.com for the security-questionnaire workbook (SIG-Lite / CAIQ / custom) or to report a vulnerability.

1. Data protection

Layer	Control
Transport	TLS 1.3 on every endpoint (app.finacra.com, api.finacra.com, app.itr.finacra.com). HSTS preload enabled. HTTP redirects to HTTPS.
Application-layer secrets	OAuth tokens, portal-credentials-vault entries, webhook secrets: AES-256-GCM with a per-row IV, key managed in environment + rotated quarterly.
Database (Supabase Postgres)	AES-256 at-rest disk encryption (AWS RDS-managed). Daily snapshots, 30-day retention, encrypted.
Application storage (Vercel)	Function-level isolation; ephemeral filesystems; no on-disk customer data outside the database / object store.
Document object store	AES-256 server-side encryption + signed-URL access (default 60s expiry). Audit log captures every signed-URL mint.
Backups	Daily DB snapshot + transaction-log continuous archive; recovery target RPO ≤ 24 hours, RTO ≤ 4 hours.

2. Access control + authentication

Customer sign-in: Google OAuth or Resend-delivered email magic link. Sessions are database-backed (not stateless JWTs) so revocation is immediate. Session cookies are httpOnly + secure + sameSite=lax.
Per-company RBAC: every page under /c/[companyId]/... re-authorises membership on every render. A revoked member loses access on the next click.
Reveal-on-OTP gate on the portal-credentials vault — a one-time code is required to reveal a stored credential, even for an admin.
MFA: enforced for Finacra employees via Google Workspace; customer-side MFA today is via the OAuth provider (Google), with a dedicated credentials-vault OTP gate already shipped. Customer-side TOTP / passkey MFA on the Finacra account itself is on the roadmap for Q3 2026.
Production access for Finacra engineers is principle-of-least-privilege via short-lived credentials. No shared accounts; every action is logged.

3. Audit + activity logs

Every meaningful state change is appended to a per-company audit log: sign-in, company-edit, document upload / delete, credential reveal, consent acceptance, OAuth integration connect / disconnect, agent proposal approval, ITR / FS download. Stored for 3 years; customer-exportable via the export endpoint (Art. 15).

Application telemetry (latency, error rates, route counts) flows to a separate, PII-stripped store retained for 90 days for operational debugging.

4. Vulnerability disclosure

Report security issues to ibrahim@finacra.com. We acknowledge within 1 business day and aim to triage within 5 business days. We do not currently run a paid bug bounty; we credit responsible reporters publicly when they consent.

Please don't test on production customer data — we'll provision a read-only sandbox if you need to validate a finding. No public disclosure for 90 days from report, or until a patch is shipped, whichever is sooner.

5. Incident response

Detect — error-rate alerts, anomaly detection on authentication, integration-OAuth failure spikes.
Contain — revoke compromised tokens (Auth.js session table + OAuth integration table). Block IPs at the edge if scoped to a probe.
Notify — affected customers within 72 hoursof awareness; regulators per Privacy §8.
Remediate — patch + ship + verify; post-mortem within 10 business days, customer-visible summary when scope warrants.
Improve — every incident produces at least one durable control change.

6. Software-development lifecycle

All production changes are reviewed pull requests. Direct pushes to main are blocked.
Type-checked TypeScript across the monorepo; CI runs tsc --noEmit on every PR.
Dependency scanning via GitHub Dependabot. Critical advisories patched within 7 days.
Secrets management via Vercel Environment Variables (encrypted at rest, audit-logged on read). No secrets in repo; pre-commit hook scans for accidental leaks.
Pre-prod smoke tests on every push: typecheck + Playwright end-to-end pass + bundle-size budget.

7. Sub-processors

Every sub-processor we use, its region, its DPA reference, and what data it sees is enumerated at /sub-processors. That page is also the canonical change log — material additions are notified to customers 30 days in advance via email + a banner on /security.

8. Compliance posture

DPDP Act 2023 (India) — operating as Significant Data Fiduciary processor for SMB customers.
GDPR / UK GDPR — Standard Contractual Clauses with every cross-border sub-processor; DPO appointed at ibrahim@finacra.com.
PDPL (Saudi Arabia) — in-region deployment available on request for SDAIA-supervised entities.
SOC 2 Type 1: scoped + auditor engagement Q4 2026; Type 2 follows.
ISO 27001: gap analysis complete; certification engagement Q1 2027.

9. Customer-side security controls

Revoke a team member at any time on the Team tab — sessions die on next request.
Disconnect any OAuth integration on the Integrations tab — tokens are deleted, not just hidden.
Reveal a stored portal credential only after an OTP gate; the audit log captures the reveal.
Self-service data export + account deletion at /me/data-export and /me/delete-account.

10. AI / LLM safety

No training on customer data — every LLM contract pins zero-retention endpoints.
Prompts are sanitised: customer PII is templated, not concatenated into prompts.
All write-back actions (booking entries, sending invoices, paying vendors) are human-gated regardless of AI confidence (the “T3 gate”).
LLM-generated outputs that touch a filing (validation reports, ITR JSONs) pass through a deterministic validator before delivery.