Trust and security
Your books, kept private. Kept safe.
What we do to protect your books today, in plain words. Nothing on this page is a plan or a promise of something later.
Your books stay yours
Only the people a business invites can see its books, and that includes us.
- Each business's records are kept apart from every other business's, and every screen and report is limited to the business you're in.
- Our staff console shows account and subscription details and counts. It never shows your documents, amounts, customers or suppliers, and it has no way to sign in as you.
- We don't sell your data, share it for advertising, or let our AI providers train on it.
- Accountants see a client's books only after the client connects them, and the client can remove them at any time.
Signing in
Most break-ins start with a stolen password, so sign-in has several layers.
- Passwords are stored only as a one-way hash, and new passwords are checked against lists of known breached passwords.
- Two-step sign-in with an authenticator app, with one-time recovery codes. An owner can require it for everyone in the business; accountants' seats always need it.
- Repeated wrong passwords pause sign-in for that account, and we email you when your account is used from a new device.
- Sessions end after 7 days. Sign out everywhere ends every session at once, and your recent sign-in activity is listed in Settings.
- Sensitive changes (team and roles, API keys, bank connections, billing, the full data download) ask you to confirm your password if you haven't signed in within 30 minutes.
How data is protected
Encrypted on the way and at rest, and reachable only through the app.
- Every connection uses HTTPS, and our hosting providers encrypt data at rest.
- Secrets the app keeps, such as two-step sign-in keys, connection tokens for linked services, webhook signing secrets and supplier tax IDs, are also encrypted by the app itself (AES-256-GCM).
- Only the app uses the database. Its public data API is switched off, and every table has row-level security with no public access.
- Uploaded files such as receipts are checked by their content, stored under names the app makes up, and served only through links that check who is asking.
- Pages carry a strict content security policy, so scripts from anywhere else can't run inside the app.
Records you can rely on
The same rules an auditor expects, enforced by the database as well as the app.
- Every journal entry must balance, and money is stored in whole cents, never as rounded decimals.
- Posted entries can't be edited. Corrections are made with a reversing entry linked to the original.
- Every change to accounting data records who made it, when, and what it looked like before and after.
- Once you lock a period, nothing can be posted into it.
Backups and your own copy
You can always take your books with you.
- The database is backed up every day by our database provider.
- Owners and accountants can download a business's complete data at any time (Settings → Billing → Download all data), even after cancelling.
Where data lives
In the United States, with a short list of providers.
- Our app servers, database and file storage are in the United States.
- Every outside service that handles your data, and what it's used for, is listed in our privacy policy.
- AI features send only what the task needs (a receipt image, or your question and the figures it's about). We don't store the prompts or the answers, and AI only suggests: nothing posts until a person saves it.
Found a problem?
Tell us about a security issue
Email support@nooblyf.com with "Security" in the subject. Please give us a chance to fix it before telling anyone else, and don't open other people's data while you look. If a breach affects your data, we'll tell you without undue delay.
Plainly
What we don't claim
We haven't been through a SOC 2 or similar outside audit yet. If your business needs one before signing up, email us and we'll tell you where we stand.
Last updated Oct 31, 2026