Security at Finify
Your sales and tax data deserve serious protection. Here is how we keep it safe, in plain language, with the technical detail for whoever checks it.
- Stored in the EUand never moved outside it
- Encryptedin transit and at rest
- Two-step sign-inrequired on every account
- Strictly separatedyou only ever see your own data
Where your data is stored
- Everything you put into Finify is stored with Amazon Web Services (AWS) in its EU region in Ireland. It never leaves the European Economic Area, and technical controls block the use of any other region.
- Backup copies are kept in a second EU region, in Frankfurt.
How it’s protected
- Everything travelling between you and Finify is encrypted (TLS 1.2 or higher).
- Everything we store is encrypted too: databases, uploaded files, backups and logs.
- Our website address and our email are protected against forgery (DNSSEC, SPF, DKIM and DMARC), so an email that claims to come from Finify can’t easily be faked.
Who can see your data
- Only you. Every customer sees only their own data. This is checked twice: in the application and in the database itself (row-level security). A single bug in the application isn’t enough to show one customer’s data to another.
- Our staff only when a task requires it. Access is temporary, limited to that task, and requires single sign-on with two-step verification.
- Everything is recorded. Every administrative action is written to audit logs that can’t be changed unnoticed, kept for at least one year.
- The live environment is fully separate from testing and development, and the application reaches the database without stored passwords, using short-lived credentials.
Secure sign-in
- Every account requires two-step verification: your password plus a code from an authenticator app.
- Known leaked passwords are refused. If a sign-in looks unusual, we ask for extra verification; if it looks dangerous, we block it.
- A web application firewall filters malicious traffic and limits repeated login attempts.
- Sessions expire quickly, so a forgotten open session isn’t a lasting risk.
Monitoring, backups and incidents
- Our environment is monitored around the clock with automated threat detection, vulnerability scanning and configuration checks against industry benchmarks (CIS and AWS Foundational Security Best Practices). Critical findings alert our team straight away.
- Data is backed up automatically, with a copy in a second EU region, and we test restoring from those backups.
- If a security incident affects your data, we tell you [without undue delay, and within 72 hours], with what happened and what we’re doing about it.
Privacy and your agreement with us
- We process personal data in line with the GDPR. Our privacy statement explains what we collect, why, and how long we keep it.
- We sign a data processing agreement with every customer. [Ask us for it / link to the agreement.]
- When you leave, [you can export your data first, and we delete it within x days, including from backups after y days].
Found a security issue?
Please email info@finify.tax. We appreciate responsible disclosure, reply within one business day and keep you updated until it’s fixed. The details are in our security.txt.