SECURITY OVERVIEW · REVIEWED SEPTEMBER 9, 2026
ConsulBooks handles sensitive financial records. We publish the concrete safeguards in the current product, distinguish provider responsibilities, and do not claim certifications or absolute security that we have not earned.
Supabase handles ConsulBooks email/password authentication and authenticator enrollment. ConsulBooks then requires the password-authenticated session plus a current TOTP authenticator code before the financial workspace, financial APIs, or Plaid Link can open.
Plaid Link handles institution discovery, bank authentication, consent, and account selection. You enter any required bank credentials in Plaid's connection flow; ConsulBooks does not receive or store the bank username or password.
Plaid access tokens are encrypted before database storage with AES-256-GCM, a random 96-bit initialization vector, and a server-side 32-byte key. Secrets never ship to browser code.
ConsulBooks checks the signed Plaid webhook JWT, timestamp, key identity, signature, and raw-body SHA-256 before accepting an event. Body size, key fetching, and connection requests are bounded.
Owner writes are resolved through the authenticated owner's business ID. An invited accountant receives separately authenticated, MFA-protected, read-only access only to explicitly accepted workspaces; report queries remain business-scoped.
Important imports, approvals, rules, connection events, accountant access changes, exports, and support actions are recorded while the workspace exists. The accountant package is generated only after ledger-integrity checks and a final permission and data-revision check.
External AI suggestions are off unless the owner opts in. Only uncertain items are eligible, using minimized fields such as shortened merchant text, direction, coarse amount band, industry, and entity type.
The owner can revoke accountant access, disconnect an institution, or permanently delete the bookkeeping workspace. Signing out ends the ConsulBooks session; it does not disconnect a financial institution. An invited accountant cannot edit books or manage connections.
FINANCIAL DATA FLOW
The institution authentication and account-selection experience is provided by Plaid.
The server encrypts the token; the browser never receives the long-lived access token.
Pending items are skipped until posted. Updates are deduplicated and tied to the selected financial account.
Human decisions and important changes remain in the workspace audit history.
WHAT WE DO NOT CLAIM
ConsulBooks does not currently claim SOC 2 certification, ISO 27001 certification, PCI certification, passkey or phishing-resistant MFA, “unhackable,” “zero-knowledge,” “bank-grade,” an immutable audit log, or categorically stronger security than QuickBooks, Xero, or another provider.
Security is a continuing operating program, not a landing-page badge. The service may change as controls, independent review, incident processes, vendor management, and customer access mature. Downloaded exports are outside ConsulBooks' controls and must be stored and transmitted securely by the customer or accountant.
To report a potential vulnerability, suspected account compromise, or security concern, email security@consulbooks.com. We investigate reports and notify affected users when required by law. Do not include bank credentials, passwords, access tokens, or unnecessary personal data.
RELEVANT DOCUMENTS