Security
How your data is protected. If your auditor or IT team has a question this page does not answer, email us and we will answer it directly.
Encryption
All traffic is encrypted in transit with TLS. Data is encrypted at rest.
Tenant isolation
Every table that holds your data enforces row-level security in the database, checked on every query. A test suite verifies that every tenant-scoped table carries the policy.
Your browser never touches the database
All data access happens server-side. There is no path from a browser, yours or anyone else's, to the database.
QuickBooks credentials
QuickBooks Online connects through OAuth, so we never see your QuickBooks password. Connection credentials that must be stored, including QuickBooks Desktop connector secrets, are encrypted at rest with AES-256-GCM envelope encryption.
Wrong-file protection
Each connection is pinned to its QuickBooks company. A Desktop sync that finds a different company file open freezes loudly instead of posting into the wrong books.
Payments
A customer paying through your portal enters their card or bank details on Stripe's own hosted checkout. Steda never sees a card number and never holds funds; the Stripe account is yours and outlives your relationship with Steda.
Portal sign-in
Your customers sign in with a per-customer link or an emailed six-digit code, never a password to lose. A customer sees one account at a time, and the fence between customers is a database policy every portal table carries.
Documents
Invoices, statements, and anything a customer uploads live in private storage. Every download goes through a row lookup and a short-lived signed link, with a size and file-type limit and a storage allowance per company.
Audit trail
The audit log is append-only. Closes, reopens, imports, postings, and edits are recorded with who and when, and nothing is edited after the fact.
Period locks and roles
Locked periods and segregation of duties are enforced once, for the whole product. A closed month is closed in every module.
Backups
Your data lives in a managed Postgres service (Supabase, hosted on AWS in the United States) on a paid plan with automated daily backups retained for seven days, in addition to the append-only audit trail and period snapshots inside the application. Ask us for the current backup and recovery details and we will send them.
Leaving Steda
Export everything, in Excel and CSV, always, including after your subscription lapses. If your account is ever suspended for non-payment, it becomes read-only with exports still working.
Questions
Is Steda SOC 2 certified?
Not yet. The controls described above are real, and we will complete a security questionnaire for any serious evaluation. Certification will come when customer requirements call for it.
Does Steda support multi-factor authentication?
Not yet. Tell us if it is a requirement for your evaluation and we will factor it into when we build it.
Who sees my data?
Your data is accessed for support only with your knowledge. It is never sold, never used to train anything, and never shown to another customer.