Security & Data Handling

The short version

TheAccounts.ai is built and operated by one person — there is no separate security team, and no group of employees or contractors with standing access to customer data. Production access is limited to the founder. That is a real trade-off in both directions: fixes and answers come directly from the person who wrote the code, without the redundancy a larger team provides. Every specific claim on this page is written so it can be checked against our actual infrastructure and processor agreements, not taken on faith.

What data we collect

We collect three kinds of data:

• Account details — your name, email address, business name, Tax Registration Number, and phone number if you provide one.
• Financial data you enter or upload — receipt and invoice images, the line-item data extracted from them, bank transaction data if you use bank reconciliation, the resulting ledger entries, and VAT and Corporate Tax computations.
• Usage data — login activity and basic device/browser information, used to keep the service reliable and to prevent abuse.

How receipt scanning works — AI processing disclosed

Receipt and invoice OCR is powered by Anthropic's Claude API. When you upload a receipt or invoice, the image and the data extracted from it are sent to Anthropic to be read and categorised. This is a genuine sub-processor relationship and we would rather disclose it plainly here than leave it implicit.

[CONFIRM: confirm which Anthropic API plan and data-processing terms apply to this account, and whether that agreement excludes this data from model training. Link to Anthropic's current privacy and data-use terms here rather than relying on this summary, since those terms can change.]

Where data is stored, and our sub-processors

We rely on a small number of trusted providers to run the service — the same providers disclosed on our Privacy Policy:

• Application hosting — Vercel, which also terminates TLS for the app and every API route.
• Database — a managed PostgreSQL database. [CONFIRM: this page was drafted from the project's deployment configuration, which points to Neon (managed PostgreSQL, AWS eu-central-1 / Frankfurt) — confirm this is still the current production database and region before publishing.]
• File storage — Cloudflare R2 object storage, separate from the database, for uploaded receipts, invoices, and logos.
• Payments — Stripe. Card details are entered directly with Stripe and are not stored on our own servers.
• Transactional email — Resend, for account, receipt, and billing emails.
• AI document processing — Anthropic, for receipt and invoice OCR (see above).

Encryption in transit and at rest

Data in transit is encrypted via HTTPS/TLS, enforced automatically by Vercel across the app and every API route.

A specific set of sensitive fields — bank-feed connection tokens, and any tax or government-portal credentials you store for a client — are encrypted at the application layer with AES-256-GCM before they are written to the database, so they are not readable as plain text even from a database export.

[CONFIRM: beyond those specific fields, confirm that at-rest encryption is enabled for the production database and for Cloudflare R2 storage. This is a setting on the infrastructure provider's side to check directly, not something this page should assume.]

Access control and authentication

You sign in with Google, or with an email and password. Passwords are hashed with bcrypt and are never stored or logged in plain text.

Inside each company, teammates are assigned one of five roles — Owner, Admin, Accountant, Member, or Viewer — and what each role can see or change is enforced on every request, not only hidden in the interface. Every change to your books is recorded in an audit log, showing who made it, when, and from what IP address, visible to Owners and Admins under Settings.

[CONFIRM: state accurately who currently has production access to the database and cloud infrastructure. If it is genuinely only the founder, say so plainly — a small, named access list is a legitimate security property, not a gap to write around. Confirm whether that access is protected by multi-factor authentication and whether it is logged.]

Backups

[CONFIRM: state the actual backup frequency and retention period for the production database, whether backups are encrypted, and where they are stored, before publishing this section. Check the database provider's console settings rather than assuming a default.]

Data retention, export, and deletion

You can export your invoices, expenses, VAT returns, Corporate Tax computations, and your full organisation data at any time from within the app — this is a self-serve feature today, not a request that has to go through support.

Deleting an account or organisation is not yet a self-serve control in the product. Email privacy@theaccounts.ai and we will process the deletion for you, subject to the tax record-keeping note below.

[CONFIRM: state how long data is kept while an account is active, and how long it is kept after an account is closed or a subscription lapses, before it is deleted. Update the deletion paragraph above if self-serve deletion ships before this page is next reviewed.]

UAE tax record-keeping

UAE tax law requires businesses to keep accounting records and supporting documents for a minimum period under Federal Tax Authority record-keeping requirements. If you close your TheAccounts.ai account, you remain responsible for keeping your own copies of your records for as long as UAE law requires — export your data before closing an account.

[CONFIRM: confirm the exact retention period that applies and link to current FTA guidance here rather than relying on this summary.]

UAE PDPL alignment

TheAccounts.ai is built with the principles of the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) in mind: data minimisation, purpose limitation, and the access, correction, and deletion rights described above.

This is a statement of design intent, not a claim of formal certification, registration, or third-party audit. TheAccounts.ai is not ISO 27001 or SOC 2 certified, and no formal PDPL compliance audit has been carried out.

[CONFIRM: have a UAE lawyer review this section before publishing. It sits next to a promise made to customers handing over tax records, and this wording should not be upgraded to imply certification without one.]

Reporting a security concern

If you find a security issue, email privacy@theaccounts.ai with details of what you found.

[CONFIRM: state a response time for security reports that can actually be met solo — see the response-time commitment on the Contact page and keep the two consistent.]

Questions

If you have questions about this page or how your data is handled, see the Contact page, or email privacy@theaccounts.ai directly.