Security at HassleFreeBooks

Your books hold your business’s most sensitive numbers, and the connections behind them hold keys to your bank and card accounts. This page summarizes how we protect both, and how to reach us about security.

Last updated: October 30, 2026

Reporting a vulnerability

Email security@hasslefreebooks.com with the steps to reproduce. This address is monitored. Please do not access, change or keep other people’s data while testing, and give us a reasonable time to fix an issue before disclosing it. We fix confirmed issues on these timelines: critical within 48 hours, high within 7 days, medium within 30 days, low within 90 days.

Accountability

Daniel J. Francis, Founder, is accountable for information security and owns our written Information Security Policy, which covers access control, encryption, infrastructure, secure development, incident response, data retention and third-party integrations. The policies are reviewed at least once a year and after any material change.

Encryption

• In transit: every page and API call is served over HTTPS (TLS 1.2 or later).
• Connection credentials: the tokens and keys that connect your bank, card, payment and commerce accounts (for example Plaid, Ramp, Stripe) are encrypted with AES-256-GCM, each record with its own IV, before they are stored.
• Passwords are stored only as bcrypt hashes; API and password-reset tokens only as SHA-256 hashes; two-factor secrets are encrypted.

Access control

• Two-factor authentication (authenticator app or SMS, with backup codes), and a fresh check before sensitive actions such as connecting a bank or creating an API key.
• Role-based access per business (owner, bookkeeper, accountant). Every query for business data is scoped to that business, and automated tests check that no route skips the scope or the role check.
• Sessions use Secure, HttpOnly, SameSite=Strict cookies and are rotated at sign-in. API tokens expire after an hour and can be revoked.
• Access to production systems is limited to the founder, and is used only to run, support and secure the service.

Where your data lives

HassleFreeBooks runs on a dedicated server in the United States, hosted by IONOS, with its data in a database on that server. We use a small number of service providers to run the product, such as Plaid for bank connections, Mailgun for email, Twilio for text-message sign-in codes and OpenAI to read the documents you upload and power the AI features you choose to use. The privacy policy lists what each receives. We never sell your data.

Connected accounts

• Connections are read-only wherever the provider allows it. We ask only for the scopes each feature needs.
• Webhooks from providers are signature-verified before anything is read from them.
• Disconnecting a connection ends its access with the provider where the provider supports it, and deletes the stored credentials.

Retention and deletion

• Accounting records are kept for the life of your account and, by default, seven years for tax and recordkeeping, then reviewed for disposal.
• Connection credentials are kept only while the connection exists and are destroyed when you disconnect or close your account.
• Sessions and tokens expire automatically. Security logs are rotated on a schedule.
• To ask what we hold about you, or to delete it, email security@hasslefreebooks.com.

Secure development

• Dependencies are checked against published advisories, and end-of-life software is tracked and reported.
• Source scans look for injection, cross-site scripting and similar flaws, and regression tests keep fixed issues fixed.
• Database access uses prepared statements throughout.

Incidents

We have a written incident response plan. If an incident affects your data, we will tell you without unreasonable delay once we know which accounts are affected, and notify the platforms and authorities the law and our agreements require.

See also our privacy policy, terms of service and security.txt.