Security
Specifics, not badges.
We’re an early company, and we’d rather show you exactly how your books are protected than wave a logo at you. Everything on this page is a statement about how the system is actually built.
Encrypted in transit and at rest
All traffic between your browser and TheGuyBooks runs over TLS. At rest, your books live in a managed Postgres database with disk-level encryption. We name the mechanisms because vague words like “bank-level” mean nothing — and we don’t use them.
Isolated at the database layer
TheGuyBooks is multi-tenant, and the separation between businesses is enforced by row-level security policies inside the database itself, in two layers — by host, and by business within a host. A screen can’t reach another business’s books, because the database refuses to serve them.
An append-only ledger
Every document — an invoice, a bill, a check — posts double-entry ledger entries. Posted entries are never silently edited: corrections post replacement entries through a sanctioned path, voids stamp the document and leave the trail, and paid documents lock until the payment chain is unwound in order. Your books stay auditable by construction.
An extra check on new devices
Sign-in has two layers. The first is always on and cannot be switched off: the first time you sign in from a browser we don’t recognise, we email you a one-time 6-digit code. Type it in and that browser is remembered for 30 days. The second layer is yours to choose — any account can turn on an authenticator app (TOTP) from Account → Sign-in security, with one-time recovery codes stored only as hashes. While the app is on, its code takes the place of the emailed one, so you are never asked for both. We do not offer SMS codes — they are the weakest second factor, so we left them out on purpose.
Sign-in that fights back
Authentication endpoints are rate-limited, and repeated failures lock the account before password guessing gets anywhere. Sign-in errors are deliberately generic, so an attacker can’t use them to learn which emails exist.
Backed up and watched
Backups run automatically on a schedule. Separately, automated ledger-invariant checks continuously verify that the books still balance — if an invariant ever breaks, we are alerted. Monitoring also covers errors in the application itself.
What we deliberately don’t claim
- We do not hold a SOC 2 attestation yet. When we engage an audit, it will be announced here — not before, and never as a badge we haven’t earned.
- We don’t say “bank-level security,” “military-grade encryption,” or “100% secure.” Nobody honest can. We name mechanisms instead, so you can hold us to them.
- We never see or store card numbers — and we won’t. Payment collection is designed to run entirely on hosted, PCI-scoped payment infrastructure.
Found something? Security reports go to Admin@theguys.app. We read every one.