Security

Sign-in and account security

• Two-step sign-in. Signing in with a password always requires a second step: a single-use six-digit code sent to your email. Codes expire after 10 minutes and are tied to the browser that started the sign-in. You can also sign in with Google, which brings Google's own account protections.
• Protection against guessing. Repeated wrong passwords or wrong codes pause sign-in, so an attacker can't simply try combinations.
• Sign out of all devices. One button in Settings ends every active session immediately. Sessions also end on their own after a period of inactivity, and changing your password or email signs out every other device.
• See what's happening on your account. Settings → Account shows recent sign-ins, wrong-password attempts, and password changes, with the time, IP address, and device.
• Passwords are never stored in readable form. They are hashed, so even we can't read them.

Who can see your books

• Roles for your team. You choose whether each person is an owner, member, or viewer, and invitations expire after 7 days.
• Changes take effect right away. When you remove someone or change their role, it applies on their very next click. It does not wait for them to sign out.
• Your data stays yours. Every request is checked on our servers against who you are and which business you belong to. Your books are never visible to another customer.
• An audit trail. The Activity page records who changed what in your books, bank connections, team, and settings.

Bank connections

• We never see your bank login. Bank connections run through Plaid, the same service used by many of the apps you already trust. You sign in on Plaid's screen, not ours.
• Read-only transaction data. BookNerd asks Plaid only for your transactions. It can't move money or make payments.
• Connection keys are encrypted. The credentials that let BookNerd keep your transactions up to date are encrypted before they are stored, using AES-256-GCM.
• Disconnect any time. Removing a bank connection revokes BookNerd's access at Plaid and stops syncing.

Your data

• Encrypted in transit. All traffic to BookNerd uses HTTPS, and we instruct browsers to only ever connect securely.
• Sensitive fields get extra protection. Bank connection credentials, payment-processor tokens, and tax ID numbers are individually encrypted before they are stored.
• Payments are processed by Stripe. BookNerd doesn't store your card number.
• Secrets stay out of our code. Keys and credentials live in our hosting provider's secure configuration, never in the code itself.
• Delete it and it's gone. Deleting your account removes your profile, your team memberships, your sign-in history, and all data of the businesses you own, including your bank connections.

How we run BookNerd

• Managed infrastructure. BookNerd runs on managed cloud services for hosting, database, and file storage. There are no servers of our own to leave unpatched.
• Two-factor on every admin account. Every account that can administer BookNerd's systems is protected with multi-factor authentication, and access is limited to the people who need it.
• Code and dependency scanning. Our code is scanned automatically for known vulnerabilities and insecure patterns on every change and every week. Dependencies are checked for security advisories, and secrets are blocked from being committed.
• Prompt fixes. We aim to fix critical vulnerabilities within 7 days and high-severity ones within 14.
• Verified webhooks. Messages from our bank-connection and payment partners are verified by signature before we act on them.

Questions or a security concern?

If you have a question about how we protect your data, or you think you've found a vulnerability, email support@booknerd.io. We read every report and will get back to you.