Security
Specifics, not badges.
We’re an early company, and we’d rather show you exactly how your books are protected than wave a logo at you. Everything on this page is a statement about how the system is actually built.
Encrypted in transit and at rest
All traffic between your browser and TheGuyBooks runs over TLS. At rest, your books live in a managed Postgres database with disk-level encryption. We name the mechanisms because vague words like “bank-level” mean nothing — and we don’t use them.
Isolated at the database layer
TheGuyBooks is multi-tenant, and the separation between businesses is enforced by row-level security policies inside the database itself, in two layers — by host, and by business within a host. A screen can’t reach another business’s books, because the database refuses to serve them.
An append-only ledger
Every document — an invoice, a bill, a check — posts double-entry ledger entries. Posted entries are never silently edited: corrections post replacement entries through a sanctioned path, voids stamp the document and leave the trail, and paid documents lock until the payment chain is unwound in order. Your books stay auditable by construction.
Two-factor sign-in
Every account can turn on authenticator-app (TOTP) two-factor sign-in, with one-time recovery codes stored only as hashes. We do not offer SMS codes — they are the weakest second factor, so we left them out on purpose.
Sign-in that fights back
Authentication endpoints are rate-limited, and repeated failures lock the account before password guessing gets anywhere. Sign-in errors are deliberately generic, so an attacker can’t use them to learn which emails exist.
Backed up and watched
Backups run automatically on a schedule. Separately, automated ledger-invariant checks continuously verify that the books still balance — if an invariant ever breaks, we are alerted. Monitoring also covers errors in the application itself.
What we deliberately don’t claim
- We do not hold a SOC 2 attestation yet. When we engage an audit, it will be announced here — not before, and never as a badge we haven’t earned.
- We don’t say “bank-level security,” “military-grade encryption,” or “100% secure.” Nobody honest can. We name mechanisms instead, so you can hold us to them.
- We never see or store card numbers — and we won’t. Payment collection is designed to run entirely on hosted, PCI-scoped payment infrastructure.
Found something? Security reports go to Admin@theguys.app. We read every one.