Security overview.
Plain-English version: your bank login never reaches our servers, our access to your bank is read-only, and BooksGPT is structurally incapable of moving your money. Below is the specific detail, including exactly which certifications we hold and which ones we do not.
01Scope & summary
What we hold: your ledger. Transactions, invoices, bills, vendors, customers, uploaded documents, and the reports built from them. What we never hold: your bank password, your card number, your account password, or any ability to move money. Those live with Plaid, Stripe, and Google, and that is deliberate.
This page describes how BooksGPT, operated by Avo LLC, protects customer data. It covers the BooksGPT web application at app.booksgpt.ai and the marketing site at booksgpt.ai. It is a companion to our Privacy Policy, which covers what we collect and why. This page covers how it is defended.
The short version of our security posture is that we removed the highest-risk assets from our own reach rather than trying to defend them. A password we never receive cannot leak from our database. A payment rail we never built cannot be abused. The sections below are mostly a description of that choice and what it leaves behind.
02Bank credentials never reach us
When you connect a bank, you are typing your login into your bank's own screen, presented by Plaid or Stripe. It is not our form, we do not proxy it, and the credential is never transmitted to a BooksGPT server. We could not show you your own bank password if you asked us to.
BooksGPT connects to banks through two providers, both regulated bank-data aggregators: Plaid and Stripe Financial Connections. Which one handles a given connection depends on your workspace setting and the institution, and you can see and change it in Settings under Bank connections.
The connection flow works like this:
- You click Connect. The provider opens its own hosted interface, which handles the institution list, the login screen, and any multi-factor prompt your bank sends.
- You authenticate directly with your bank, inside that interface. BooksGPT does not render the form, does not receive the keystrokes, and does not sit in the network path.
- Your bank returns an authorization to the provider. The provider returns to BooksGPT an opaque token that permits reading balances and transactions for the accounts you selected, and nothing else.
- That token is the only bank-related secret we hold, and it is encrypted at the field level before it is written to the database (see section 04).
Because the credential never traverses our systems, a compromise of BooksGPT does not expose your online banking login. There is nothing there to expose.
You can revoke our access from two directions, and you do not need our cooperation for either. You can disconnect the account from inside BooksGPT, and you can revoke the connection at your bank, which in most institutions appears under a linked-apps or third-party-access screen. Revoking at the bank cuts the feed immediately regardless of what our software does.
03Read-only by construction
BooksGPT cannot move your money. Not "will not," and not "is not permitted to by policy." There is no code path, no API credential, and no payment rail pointed at a customer bank account. The feature does not exist to be misused.
The authorization we receive from Plaid or Stripe Financial Connections is scoped to reading account balances and transaction history. It does not carry payment initiation, transfer, or write authority, and we do not request those scopes.
This matters more than a permissions setting normally would, because it is structural rather than configured. BooksGPT is bookkeeping software. It reads what already happened and writes it into a ledger. There is no product surface anywhere in the application that initiates a debit against a connected account, which means there is no such surface for an attacker with a stolen session, a malicious insider, or a bug to reach.
The one place money does move is your own subscription payment to us, and that runs entirely inside Stripe on a card you gave to Stripe. It has no relationship to your connected bank feeds.
04Encryption
In transit
- Every connection to booksgpt.ai and app.booksgpt.ai is served over HTTPS. TLS termination and certificate management run through Cloudflare, and current browsers negotiate TLS 1.2 or 1.3.
- Traffic between BooksGPT and every third-party service we call, including the bank-data providers, Stripe, and our AI model providers, is encrypted in transit.
At rest
- Our production database and its backups are encrypted at rest by our infrastructure providers.
- Documents you upload, which means receipts, bank statements, business logos, and the archived copies of anything you import, are stored in Cloudflare R2 and encrypted at rest. They are served only through short-lived signed URLs, never from a public bucket.
Field-level encryption
For the small number of columns that are sensitive on their own, we encrypt the individual field with AES-256-GCM before it reaches the database, on top of the storage-level encryption above. Today that covers contractor and vendor tax IDs, which may be an EIN or a Social Security number, and the access tokens issued by our bank-data providers.
One detail is worth calling out because it is unusual and we are proud of it. Each ciphertext is cryptographically bound to the row and workspace it belongs to, using the encryption mode's additional-authenticated-data field. The practical effect is that a row copied into the wrong workspace, whether by a bad import, a partial restore, or a cross-tenant bug in our own code, fails to decrypt rather than quietly rendering someone else's Social Security number on the wrong screen. The failure mode of a mistake is a clean error, not a disclosure.
If the encryption key is not configured, saving a tax ID is refused outright. It never falls back to storing the value in plaintext.
05Where your data lives
BooksGPT is a US company. Production servers, the database, and object storage are located in the United States. The subprocessors below each receive only what their function requires.
| Subprocessor | What it holds or handles | Independent attestation |
|---|---|---|
| Plaid | Bank authentication and transaction feeds. Holds the bank authorization; we never see the credential. | SOC 2 Type II |
| Stripe | Subscription and one-time payments, plus Financial Connections bank feeds. Holds your card details; they never touch our servers. | SOC 2 Type II, PCI DSS Level 1 |
| Google (Firebase Authentication) | Sign-in and account passwords. We never store or receive your password. | SOC 2 Type II |
| Cloudflare | Network edge, TLS termination, DDoS protection, and R2 object storage for uploaded documents. | SOC 2 Type II |
| Hosting provider | Application servers and the primary Postgres database, in US data centers. | See vendor |
| OpenAI, via OpenRouter | AI inference for transaction categorization and the assistant. Receives only the data a given task needs. | See vendor |
| Resend | Transactional email, including receipts and account notices. | See vendor |
| Crisp | Support chat and support email. | See vendor |
| PostHog, Google Analytics | Product and marketing analytics. Usage events, never ledger contents. | See vendor |
We do not use your books to train AI models offered to anyone else, and your books and AI conversations are never shared with an advertising network. That boundary is described in full in sections 6 and 7 of the Privacy Policy.
06Certifications & attestations
BooksGPT does not hold its own SOC 2 Type II attestation today, and our compliance programme is underway with a target of the end of October 2026. The companies that hold your bank credentials, your card, and your password are each SOC 2 Type II audited, and those are the parts of this system where such a report tells you the most.
We want to be direct about this, because a vague answer to a security question is itself a security signal.
Today we do not hold our own SOC 2 attestation. That is changing on a committed timeline rather than an aspirational one. We are building payment acceptance on invoices, which runs on Stripe Connect, and formal SOC 2 compliance is a requirement of that programme rather than an optional extra. The two are therefore being delivered together, targeted for the end of October 2026. We will publish the outcome on this page when it completes.
Here is why we think that is the right answer for a product built this way rather than a gap we are papering over. A SOC 2 report attests to the controls a company operates around the systems it runs. The assets that would carry nearly all of the risk in such a report are not systems we run:
| Sensitive asset | Who holds it | Their attestation |
|---|---|---|
| Your online banking credential | Plaid, Stripe Financial Connections | SOC 2 Type II |
| Your card number | Stripe | SOC 2 Type II, PCI DSS Level 1 |
| Your account password | Google Firebase Authentication | SOC 2 Type II |
| Uploaded documents, network edge, TLS | Cloudflare | SOC 2 Type II |
| Ability to move money from your bank | Nobody. It does not exist. | Not applicable |
What remains on our side is your ledger: transactions, invoices, vendors, documents, and reports. That is real business data and we protect it, which is what sections 04 and 07 describe. But it is not credentials and it is not money movement, because the architecture put both out of our reach on purpose.
An attestation held by a vendor does not transfer to us, and we will never claim it does. What we are saying is narrower and, we think, more useful: the specific risks a buyer is usually trying to price when they ask for a SOC 2 report are concentrated in four companies that all have one, and in a capability we deliberately never built.
If your procurement process requires a vendor SOC 2 Type II report in hand today, we do not yet have one to give you. We would rather tell you that in the first conversation than in the fourth. If you are already a customer and this is a blocker, contact us and we will refund you without an argument, or hold your seat until the programme above completes.
07Access control & authentication
How you sign in
- Authentication runs on Google Firebase Authentication. BooksGPT never stores or receives your password.
- You can sign in with Google, in which case your own Google account protections, including 2-Step Verification and any hardware key you use, apply to your BooksGPT account as well. For most customers this is the strongest option available and we recommend it.
- Sessions are validated on every authenticated request against the identity provider, not against a long-lived cookie we mint ourselves.
Inside a workspace
- Access is scoped per workspace. A user sees only workspaces they own or have been explicitly invited to, and every data query is filtered by that membership on the server.
- Invited teammates and accountants get a role. A viewer is genuinely read-only and cannot post entries, edit transactions, or change settings.
- The AI assistant inherits the acting user's role rather than exceeding it. A viewer chatting with the assistant gets read-only tools, and the check is re-evaluated against live membership immediately before any tool runs, not just when the page loaded.
- Sensitive actions, including revealing a stored tax ID, are restricted to workspace admins, audited, and recorded whether they succeed or fail.
On our side
- Production access is limited to authorized personnel and is not required for routine support.
- Administrative actions taken by our staff are written to an append-only audit log.
- Bank connections are read-only for us too. Our own staff cannot move money from a customer account for the same structural reason described in section 03.
08Retention, export & deletion
Your books are yours and they are not held hostage by the software.
- Export. You can export your complete ledger and reports at any time from the product, in PDF, CSV, or journal format. There is no lock-in and no export fee.
- Retention. We retain your books for as long as your account is active.
- Deletion. You can request account deletion at any time from inside the product or by contacting us. Deletion removes your data from our production systems on a scheduled basis. Clearing a workspace also retires the associated bank connections at the provider, so the feed stops on their side and not only on ours.
- What survives deletion. Billing records and purchase history are retained where tax and accounting law requires it. Nothing about your ledger is retained for our own commercial use.
Full detail, including your rights under the CCPA and GDPR, is in sections 9 and 10 of the Privacy Policy.
09Reporting a vulnerability
If you believe you have found a security vulnerability in BooksGPT, please tell us. We read every report and we will not threaten you for sending one in good faith.
- Email: [email protected], with "Security" in the subject line so it is routed correctly.
- Include enough detail to reproduce the issue. A URL, the steps, and what you observed is usually enough.
- We aim to acknowledge a report within two business days.
Please do not run automated scanners against production, do not access, modify, or exfiltrate another customer's data, and do not perform testing that degrades the service for other users. If you find you can reach data that is not yours, stop and report it rather than enumerating it.
We do not currently run a paid bug bounty. We will credit you publicly if you would like us to.
10Contact
Security questions, including from a procurement or vendor-review process:
- Email: [email protected]
- Chat: the support widget on this site or in the app
- Mail: Avo LLC · Attn: Security · 5151 California Avenue, Irvine, CA 92617