SECURITY & TRUST

Your books. Locked.
Your ledger. Yours.

SuperBooks reads from your bank. We never move money. Your data is encrypted in transit and at rest, and your transactions export as CSV at any time, on any plan.

CertificationsArchitectureYour dataVulnerability disclosure
Certifications & compliance
GDPR
Article 32
not externally audited
PIPEDA
Canada
not externally audited
Plaid
OAuth read-only
live

We hold no certification and have not been assessed by an external auditor. What we do today: bank access is read-only, your data is encrypted in transit and at rest, and your transactions export as CSV on any plan. Formal audit certifications will be pursued as we approach public launch. Email security@superbooks.io for our current security review.

01 — ArchitectureHow it's built

Boring infrastructure, radical defaults.

No new science. Just well-known building blocks, configured correctly, in the boring way the auditors like.

01 · client
· Browser · TLS 1.3 + HSTS
· CSP / SRI · pinned scripts only
02 · edge
· Cloudflare · edge proxy
· Rate-limit per session + IP
03 · application
· API · OWASP top-10 hardened
· Workers · every job carries its team
· Tenant boundary on every query
04 · data
· Postgres · managed backups
· Object storage · private, signed-URL access
05 · banks
· Plaid, read-only · the only live bank connection
· OAuth · read-only scopes
· Provider tokens refreshed automatically
Read-only by design
SuperBooks requests read-only scopes from every banking partner. We literally cannot move money — the OAuth tokens we hold don't have that permission.
Tenant isolation
Every query is scoped to your team at the API boundary, and every background job carries the team it belongs to.
Encryption everywhere
TLS 1.3 in transit. Encrypted at rest. We don't hold your bank credentials — Plaid does.
02 — Your dataNO LOCK-IN

If you ever want to leave,
your books leave with you.

No tar pits, no “contact support” gotchas — your transactions export on any plan, from any role.

CSV export
Every transaction, on any plan. Pick your settings and get one flat CSV — plain format, no export tier.
Open API
Read your full dataset via REST. Auth via personal access tokens. No premium-tier paywall.
Encrypted backups
Daily snapshots, encrypted and stored off-site.
Encrypted, always
Encrypted in transit and at rest. We never hold your bank credentials — your banking provider does.
Regional hosting
Hosted on encrypted infrastructure. Region and residency options will be published as we approach public launch.
Deletion on request
Cancel and request deletion; we delete or de-identify your data, subject to the legal retention our privacy policy describes.
03 — Disclosure

Found something? Tell us.

We run a coordinated disclosure program. Email security@superbooks.io with your finding. PGP key available on request.

SuperBooks is in beta and we don't offer paid rewards yet. We're working out what a reward program should look like and will publish the details here when it's ready.

04 — Get started

Stop being your own
bookkeeper.

SuperBooks is in beta — join early and the price you start on stays locked for life while you keep the subscription.

Get started Join Discord

Beta · app.superbooks.io · founding-member price lock