Isolation between companies
Separation between entities does not depend on remembering a query filter: it is enforced in the database through row-level security. A poorly written query cannot return another company’s data.
SecurityData protection Agència Andorrana de Protecció de Dades
Trust
Your accounting is yours.
Accounting software holds some of a company’s most sensitive information. These are the technical decisions we have made and the questions that remain open.
Access and identity
Two-factor authentication through an authenticator app, one-time recovery codes, login attempt limits, revocable sessions and origin validation on every sensitive request.
Activity record
Relevant events are written to an append-only log. There is no administrator action that can rewrite the past without leaving a record.
Documents
Invoices, attachments and supporting evidence are kept in private storage, never at a guessable public address. User uploads are quarantined and scanned for malware before they are processed.
Your data, portable
You can request a full export after confirming your password and two-factor authentication. It includes JSON and CSV data, referenced documents and a manifest containing each file’s checksum so you can verify that nothing is missing.
Data protection
Personal data is handled under Andorran data-protection law and the supervision of the competent authority.
02 · Open
What we can't say yet
We have not yet completed an external security audit or independent penetration test, and we have no published certifications. We say this here because we believe that an accounting provider that hides this information is a greater risk than one that publishes it.
If you have found a vulnerability, email us at security@andcompta.ad. We respond to good-faith reports and do not retaliate against the people who submit them.
Your accounting is yours.
Accounting software holds some of a company’s most sensitive information. These are the technical decisions we have made and the questions that remain open.