Security

KontraBooks holds some of your most sensitive information - your financial records. We treat protecting it as a core part of the product, not an afterthought. This page describes the concrete measures we take.

Encryption

All traffic to and from KontraBooks is encrypted in transit with TLS, and HTTPS is enforced across the entire service (with HSTS). Your data is encrypted at rest using the managed encryption provided by our cloud infrastructure.

Authentication and access

• Passwords are stored only as salted hashes - we cannot read or recover them - and weak passwords are rejected at sign-up.
• Sessions use HttpOnly, Secure, SameSite cookies, so your session token is never exposed to JavaScript.
• Access tokens are short-lived and rotated, old tokens are revoked on sign-out, and you are automatically signed out after 60 minutes of inactivity.
• Repeated failed sign-in attempts are rate-limited and locked out to block brute-force attacks.
• Access to your data is scoped by role, so team members only see what their role permits.
• Administrative access to our own systems is gated behind an identity provider with mandatory two-factor authentication.

Infrastructure

KontraBooks runs on Google Cloud Platform. Our application and database are hosted in the European Union, with managed, regularly taken backups. Internal and scheduled jobs authenticate using short-lived, signed identity tokens, and our services run with least-privilege permissions.

Your data belongs to you

The financial data you enter is yours. You can export it, or permanently delete your account and its data, at any time from your settings. We process your data only to provide the service. For the full detail of what we collect and your rights under GDPR and other privacy laws, see our Privacy Policy, and for the third parties that help us run the service, our Sub-processors list.

Responsible disclosure

If you believe you have found a security vulnerability, please email security@kontrabooks.com. We will acknowledge your report, investigate promptly, and keep you updated. We ask that you give us a reasonable opportunity to resolve the issue before any public disclosure, and that you do not access or modify other users’ data while testing.

Questions

For any other security or privacy question, contact privacy@kontrabooks.com.