Security
Your books are protected by how Fynix is built.
Accounting data is some of the most sensitive data a business has. These are the protections built into Fynix, what we will finish before launch, and how to report a problem.
Integrity of your books
Rules the database enforces.
These are not settings. They are checked by the database or the server on every write, so neither a person nor the AI can get around them.
Every entry balances.
An entry whose debits do not equal its credits is rejected whole. Part of an entry is never saved.
Nothing posts without a person.
Every posting records who confirmed it and when, at any amount and any confidence score.
The audit trail cannot be edited.
The database blocks every change and deletion to the audit log. This is enforced in the database itself, not only in the app.
Mistakes are reversed, never erased.
Entries are not deleted. A correction is a new, linked entry, so the history stays complete.
Money is exact.
Amounts are stored to four decimal places and calculated without floating-point rounding, so cents never drift.
Access
Only the right people see the right company.
- Sign-inA dedicated identity provider
- Sign-in runs through a specialist identity service with support for two-step verification, so Fynix never stores your password.
- SeparationOne company, sealed off
- Every request is tied to one company, and the database's row-level security refuses rows from any other company.
- RolesChecked on the server
- Owner, accountant, bookkeeper and employee roles are checked on the server for every page and request, not only hidden in the menu.
- AIDrafts only
- What the AI produces goes to a separate drafts area. It has no direct way to change your ledger.
- EncryptionIn transit and at rest
- This website is served only over HTTPS. In the app, data will be encrypted in transit with TLS and at rest by our database provider.
- SessionsSigned out on time
- App sessions will end after 8 hours, and AI and document limits are set per company to stop abuse.
Before launch
What we will finish before anyone's books go in.
Fynix is in development and holds no customer data today. Each item below must be done, with evidence, before launch.
- A penetration test of the finished app, covering injection, cross-site scripting, request forgery, broken access control, privilege escalation, rate limits and data exposure
- A repeat audit of row-level security on every table
- A clean dependency audit, and checks on every file upload
- A security and data-terms review of every service provider
- Preparation for a SOC 2 Type 1 report
- Published data locations for every provider, on the service providers page
- A lawyer's review of every policy on this site
Your data
You stay in control of it.
- Full export
- Export every entry and every report at any time, in formats Excel opens.
- Deletion
- Ask us to delete your company's data and we will, except where the law requires us to keep a record.
- No selling
- We do not sell your data or use it for advertising.
- Incidents
- If a breach creates a real risk of significant harm, we will tell you and report it to the privacy regulators, as Canadian law requires.
- AI providers
- What AI providers receive, and where, is explained on AI and your data.
Responsible disclosure
Found a security issue? Tell us.
Email founder@usefynix.com with the subject "Security report". Include what you found, where, and the steps to see it.
Our contact details for security researchers are also published at /.well-known/security.txt.
What we ask of you.
Do not access, change or delete data that is not yours. Do not disrupt the service or test on other people's accounts. Give us reasonable time to fix the issue before telling anyone else.
What we will do.
Confirm we received your report, keep you updated while we fix it, and tell you when it is fixed.
Good faith.
If you follow these rules, we will not take legal action against you for your research.