Security
Your data stays closed even when a layer is forgotten
The question that matters in a multi-tenant finance application is whether another company's data could ever become visible. We do not answer it with a single control. Authorization is enforced in the application layer and tenant isolation independently in the database.
Three independent layers
Each layer works without knowing about the others. A mistake in one does not open the data.
Role-based authorization
Every endpoint denies by default. Access requires company membership, the right role and record ownership together. The roles are Admin, Finance, Accounting, Sales, Production and Manager. The role is always read from the server-side session; nothing the browser sends is ever treated as a source of authority.
Plan and subscription gate
A feature is open only if the subscription is valid and the plan includes it. The check lives in the data layer, so it cannot be bypassed by changing the interface.
Tenant isolation in the database
Every company-owned table carries a company id and PostgreSQL row-level security is forced on it. The application connects with a database role that has no power to bypass those rules, and the active company is set per request. Even if an authorization check were forgotten in code, the query simply never sees another company's rows.
Day to day
Session handling
Sessions are kept server-side; the browser only receives a cookie that JavaScript cannot read and that is only sent over HTTPS. Because the session lives on the server, it can be revoked instantly. Credentials are never kept in browser storage.
Two-factor authentication
Users can add a second step to their account with a time-based one-time code (TOTP).
Card details never reach us
Subscription payments are taken on the payment provider's own page. Card numbers never arrive at our servers; we hold only an opaque reference issued by the provider.
Encrypted transport
All traffic is carried over HTTPS and certificates renew automatically.
Audit trail
Sensitive actions such as deferrals, approvals and support access are recorded with who did them and when.
Secrets are never logged
Passwords, session keys and payment-provider keys are never written to a log line, and are scrubbed from error reports.
AI and your data
AI commentary runs on the top plan and only with explicit, per-company consent. While it is off, no data leaves at all.
- AI never computes a number. Every amount is calculated by the deterministic engine; the model only turns finished results into sentences.
- Only derived summary data goes out, and personal or company names are replaced with pseudonymous codes.
- Numbers in the generated text are checked against the source facts; if they do not match, the text is not used.
- With the feature off, the same commentary is produced from localized templates — no request leaves our infrastructure.
Hosting and monitoring
Our own infrastructure
The application, database and file storage run on a single managed server inside a closed network.
Our own error tracking
Error reports go to error tracking on our own infrastructure, not to a third-party service.
Continuous monitoring
Service availability, resource usage and application logs are monitored continuously.
Reporting a vulnerability
If you have found a security issue, please write to us before disclosing it publicly. We will review your report and come back to you.
Email the security teamScope note
Pusulafin is not an accounting or tax-computation program and gives no legal or financial advice. It tracks financial and calendar states; compliance remains your company's responsibility.
See your cash position in 30 seconds tomorrow morning
Sign up, create your company and enter your first sale. No card required, and every Pro feature is unlocked for 14 days.
Free for 14 days · No card required