Security

Your books deserve better than a password

Payroll, invoices, bank balances and tax filings live in ParmLedger, so we treat security as part of the product. Here's how your workspace is protected, in plain language.

Read the full security documentReport a vulnerability

Sign-in protection

Two-factor authentication, enforced

A stolen password isn't enough to get into a protected account. 2FA is enforced by the database itself, not just the sign-in screen, across the web app, the mobile app and every file and data request.

  • Two-factor authentication with any authenticator app (Google Authenticator, Microsoft Authenticator, 1Password and others)
  • On Growth and Pro, workspace owners can require 2FA for every member. Members without it can't access any workspace data until they set it up
  • One-time backup codes, so a lost phone doesn't mean a lost account
  • Email alerts for every sign-in security change, plus a security activity log in Account settings
  • Sign out every other device in one click, and recovering an account does it automatically
  • ParmLedger staff who reset someone's 2FA must use 2FA themselves

How we protect your data

Security in every layer

Encrypted everywhere

All traffic uses HTTPS (TLS), with HSTS so browsers never fall back to plain HTTP. Our database and file storage provider encrypts data at rest.

Workspaces kept apart

Row-level security rules in the database separate each workspace's data, so a signed-in user can only reach the workspaces they belong to.

The right access for each person

Roles for owners, approvers, adders, viewers, cashiers, accountants and auditors, plus per-person permission overrides and branch assignments.

A record of who did what

An audit log records key actions in each workspace, and approval workflows keep a trail on every expense from draft to payment.

Backups you control

Our database provider keeps backups, and owners can download a complete backup of their workspace, including attachments, at any time.

Mistakes are recoverable

Deleted items stay in a recycle bin for 30 days. Sensitive actions, like deleting a workspace, ask for your password again.

No card numbers, ever

Card and mobile money details are entered only on pages hosted by Paystack, Stripe or Flutterwave. Their payment webhooks are verified before we accept them.

Hardened by default

Strong password rules, disposable-email sign-ups blocked, rate-limited public pages, a strict Content Security Policy, and no advertising or analytics scripts in the app.

Straight answers

Questions buyers ask us

Is ParmLedger certified (SOC 2, ISO 27001)?
Not yet, and we won't pretend otherwise. This page and our Security & Reliability document describe the safeguards we actually run. Payment card security is handled by our payment providers, who are responsible for PCI DSS compliance.
Where is my data hosted?
On managed cloud infrastructure from established providers, which encrypt data at rest. We don't run our own data centres. Other services that handle data for us, such as payments and email, are listed on our Subprocessors page.
How does ParmLedger handle Ghana's Data Protection Act?
Our Privacy Policy and Data Processing Terms are written around the Data Protection Act, 2012 (Act 843). If a breach affects personal data, we aim to notify affected customers within 72 hours, and notify the Data Protection Commission where the law requires.
What uptime do you commit to?
We target 99.5% uptime each month for the web app and the services behind it, not counting planned maintenance announced in advance. It's a target rather than a contractual guarantee. Live status and incident history are on our status page.
Can I get my data out?
Yes. Owners can export data and download a full workspace backup from Settings at any time, and can delete a workspace or account themselves.
What if I lose the phone with my authenticator app?
Sign in with one of your backup codes. That turns two-factor authentication off, signs out your other devices and emails you, so you can set it up again on your new phone. If you've lost your backup codes too, ParmLedger support can reset 2FA after confirming your identity.
How do I report a vulnerability?
Email security@devarps.com with a description, steps to reproduce and the affected URLs. We won't take legal action against good-faith research that follows our responsible disclosure guidelines.

Have a security questionnaire?

Send it over. We'll answer it honestly and point you to the documents behind each answer.

Email the security teamView pricing