Security

What happens to what you put in.

Accounts

Passwords are stored as a scrypt hash with a per-account salt, never in a form that can be read back. A session is a row in the database rather than a self-contained token, so signing out really ends the session and an administrator disabling an account ends its sessions immediately. Google sign-in, where configured, links to the account that already owns the address rather than creating a second one, and refuses an unverified address.

Who can see what

Every record belongs to one organisation, and every query is keyed on the organisation resolved from your session rather than on anything in the request. There are three roles. An administrator changes the checks, the approval policy and the membership; an approver adds invoices and decides them; a viewer reads. An approver or viewer can additionally be scoped to named salespeople or named customers, and then sees only those invoices.

Documents

An uploaded file is stored under a generated name on a disk that is not the web root, never under the name it arrived with. Its type is determined from its contents rather than its extension, and it is served back with headers that stop the browser treating it as a page. Size is capped at the point of upload, and an oversized file is refused rather than truncated.

The record of what happened

Every decision, every change to a check or the approval policy, and every time an invoice was opened is written to an audit log that the database itself refuses to update or delete. Decisions are appended, never edited: changing your mind about an invoice writes a second decision, and both are visible. Nothing rewrites a financial record in place.

A validation keeps a copy of the rules as they were when it ran, so explaining a decision from last year does not mean re-reading rules somebody has since retuned.

Automatic approval

Off by default and off until an administrator explicitly enables it. When it is on, it applies only where every check passed and every confidence threshold was met, the decision is recorded as the system's rather than a person's, and switching it on or off is its own entry in the audit trail.

What this is not

This is an early version. It has not been through an external security review, it holds commercial data rather than card data, and it makes no compliance claim. If you find something wrong with it,say so — that form goes to the people who maintain it.