Security

Your documents, not your logins.

Everything runs on documents you send to an address you created. No login to your accounting system — the one exception is the API tier, where you choose to have postings written in, and that access is scoped and revocable.

Access

Two lists.

We never ask for

Your accounting loginWe do not log into QuickBooks, Sage, NetSuite or your own system. On the API tier you grant a write-only integration credential you can revoke; nobody signs in as a person.
Anything that can move moneyNothing we build touches payment initiation. Releasing money stays inside your process.
Your main mailboxCollection runs on a separate address you create, not on the one your team lives in.
Your correspondenceThe forwarding rule passes attachments from senders on your supplier list. Everything else never leaves your mailbox.
Any access at all, for the diagnosticThat step needs an exported file and a folder of documents — no logins, no connections.

We work with

A file your system importsOr an interface you set up and control yourself.
A flag for a personThe pipe stops at telling someone a payment deserves a second look.
A forwarding rule you ownDeleting it ends the access in under a minute, without our help.
One exported fileNothing installed, nothing to switch off afterwards.

In practice

What access exists, in full.

Not a policy — an inventory. This is the whole list, and every line on it is something you can end without asking us.

What	Who holds it	How you end it
The collection mailboxThe address you create for this, and nothing else	Us	Change its password
The forwarding ruleWritten by you, in the mailbox your team already uses	You	Delete it — the flow stops that minute
Your vendor and order listsExported files, sent once	Both	Ask, and your copies go with written confirmation
Your accounting system	You, only	Nothing to end — we never had it. API tier: you revoke the integration credential

Questions about access?

[email protected]

Where to start How we handle your documents