Built to hold owner tax IDs and bank details

Data protection

• Tax IDs and bank account numbers are encrypted in the application with managed keys before they are stored.
• Screens and APIs show these values only as the last four digits. Decryption is limited to the tasks that need it, such as payment files and tax forms, and each decryption is logged.
• Changing bank details needs its own permission, separate from editing an owner's address or name, and refused attempts are logged.
• Duplicate tax ID checks use a keyed hash, so the clear value is never searched.
• Data is encrypted in transit with TLS and at rest by the cloud platform.

Customer isolation

• Every customer table carries a tenant key, and PostgreSQL row-level security enforces it in the database.
• The application applies the same tenant filter to every data operation, so isolation does not depend on any single layer.

Access control

• Sign-in with password rules, account lockout after repeated failures and limits on session length.
• Session cookies are secure and HTTP-only, and signing out ends the session on the server.
• Role- and attribute-based permissions: each user sees and changes only what their roles and their assigned companies, states or records allow.
• Field-level masking and secure, expiring share links for documents.
• Single sign-on through your identity provider and multifactor authentication are on our roadmap.

Audit and traceability

• Every create, change, approval, import, export, sign-in and permission event is retained in an audit log.
• Earlier versions, submissions and rejections are kept, never overwritten.
• Every imported or AI-extracted value records its source, version, reviewer and timestamp.

AI and your documents

• Tax IDs and bank numbers are redacted before text is stored or sent for extraction.
• The model name and version are stored with every extracted value, and people approve material changes.

Infrastructure and operations

• AcreLogic runs on Google Cloud in the United States, on managed services for the application and the database.
• Secrets such as database passwords and encryption keys are held in a managed secret store, never in source code.
• The database is backed up daily, and every release takes a backup before it changes the schema.
• Each release is tested before it is deployed, and its dependencies are scanned for known vulnerabilities.
• Application logs never contain passwords, tokens, tax IDs or bank numbers.

Questions from your security team

We are happy to complete security questionnaires and walk your team through the architecture. Contact us.