Security and trust

Your data stays yours

• Every workspace is isolated from every other workspace inside the database itself (PostgreSQL row-level security, enforced even for the application’s own database role), and automated tests fail if a new table is added without that protection.
• Documents and uploaded files sit in private storage and are opened only through links that expire.
• Receipt scanning runs on our own servers. A receipt image is not sent to any other company for it.
• We do not store card numbers. Payments are made through Stripe, to your own Stripe account.

Signing in

• Email addresses are confirmed before first sign-in, and sign-in, sign-up and password reset are protected by a bot check and rate limits shared across all servers.
• Two-step sign-in with an authenticator app (and one-time backup codes) is available to every user in Settings → Profile. We recommend it for workspace owners.
• Your clients’ portal links are single-use and expire after 15 minutes; a portal session ends after 24 hours.
• Roles are enforced on the server: a viewer can read but never change anything, and only owners reach billing.

Records you can rely on

• A sent invoice is never edited or voided. It is corrected only by a credit note, which has its own number series and a stated reason.
• Invoice and credit-note numbers are sequential per workspace and allocated by the database, so two people sending at once cannot get the same number.
• The activity trail is append-only: the database refuses to edit or delete its entries, and each entry is chained to the previous one with a SHA-256 hash. Settings → Company shows whether the chain of your workspace is intact. This makes tampering visible; it is not a certification.
• A signed contract or proposal is a write-once PDF. We store a SHA-256 fingerprint of the document before and after signing, with the signer’s email verification, time, IP address and browser, as evidence.

How we build and run it

• Security headers and a strict content-security policy are on for every page, and our automated browser tests fail on any policy violation.
• Dependencies are audited on every change, and a known high-severity vulnerability in code that ships to production blocks the release.
• The platform admin console sits behind a separate second step, and the admin interface is closed unless that step is configured.
• Production changes are released deliberately, after running on a separate staging environment first.

What we have not done yet

• No independent certification yet (such as ISO 27001 or SOC 2).
• No external penetration test report yet. We have run automated scans (OWASP ZAP baseline) and load tests ourselves.
• Consilaro is a CRM and invoicing tool, not a general ledger or tax-filing system. Your accountant remains responsible for your books and returns.

Companies that process data for us

These providers process personal data on our instructions. Some are used only when you switch a feature on. Transfers outside the EEA are described in our privacy policy.