Security and vulnerability reporting
Policy version: Hybrid 9.3 · Updated 14 September 2026
Report a security issue
Contact the address shown on our Contact page. Include the affected URL, a minimal reproduction and the impact. Do not include passwords, tokens, real spreadsheet records or other people’s data. We review reports privately; please allow time for investigation before public disclosure.
Application controls
The application uses CSRF checks for state changes, native prepared database statements, protected authenticated routes, administrator TOTP with recovery codes, session expiry and revocation. Configured secrets and database snapshots use authenticated encryption. These controls reduce risk; they do not make spreadsheet output a certified accounting or audit opinion.
Files and backups
Public tools and the local Reconcile workspace process files on the device. The optional server workspace has a separate consent and retention boundary. Backups contain database data and require the original application key for restoration. The operator must protect hosting access and separately back up retained server files.
Deployment responsibilities
HTTPS, hosting patches, file permissions, mail delivery and external provider configuration are maintained by the operator. A Content Security Policy limits script origins. Policies and controls are periodically reviewed; contact us if observed behavior differs from these descriptions.