Your books, kept confidential.
Qontab holds some of your company's most sensitive data. Here is exactly how we protect it — and an honest account of what we have in place today versus what we are still building.
Last updated: September 16, 2026
We don't oversell our security.
We are a young product. We are not SOC 2 or ISO 27001 certified, we do not yet commission third-party penetration tests, and we run on a single, hardened server in an OVHcloud data centre in France until our growth justifies more. We will never claim a certification we do not hold. Everything below is real and verifiable in our code and infrastructure.
Encryption
Every connection is encrypted with TLS — version 1.2 at minimum, 1.3 negotiated by any modern browser — and enforced at our edge with HSTS (one year, with subdomains and preload). Plain HTTP only ever redirects to HTTPS.
Sensitive stored secrets — such as the API keys for AI features — are sealed with AES-256-GCM authenticated encryption before they reach the database. The encryption key is kept in the server's environment, never in the database.
Tenant isolation
Qontab is multi-tenant, but your data is fenced off from every other customer. Only our API layer is allowed to touch the database, and it scopes every read and write to your company. Your membership of that company is checked on every request.
This isolation is enforced in application code, and it is tested. As defense-in-depth, we are adding database-level Row-Level Security underneath this application-level guarantee (see “what we're working on” below).
Authentication & access
- Sessions. Stored in HTTP-only, secure cookies — never readable by page scripts, never kept in localStorage where an XSS could steal them.
- Two-factor & passkeys. TOTP two-factor authentication and WebAuthn passkeys are available on every account.
- AI / MCP access. AI assistants connect through OAuth 2.1 with PKCE; access tokens are short-lived and scoped to read-only or read-write.
- API keys. Scoped, revocable, and they expire (after one year at most). We store only a SHA-256 hash and compare it in constant time; the secret is shown once and never recoverable.
- Role-based access. Every resource and action is gated by role (owner, admin, accountant, advisor, viewer), and unapproved accounts are blocked by default. You choose who you invite, with which role.
Infrastructure
Application containers run read-only, drop all Linux capabilities and cannot gain new privileges. The database, object storage and cache sit on internal-only networks with no public route.
Administration and dashboards are reachable only over our private Tailscale network — there is no public SSH. Our edge proxy blocks common scanners and abusive paths. CrowdSec continuously analyses access logs for attacks, and the proxy refuses requests from any IP address CrowdSec has banned.
Monitoring & audit trail
A tenant-scoped audit trail records who did what on your books — creations, edits, deletions, postings, approvals and team changes — with the actor, the time, the IP address and browser it came from, and the before/after state. Sign-ins, failed sign-in attempts, sign-outs, two-factor changes and API-key creation or revocation are recorded too. Only your company's owners and admins see other members' sign-ins, IP addresses and browsers. Writing it never blocks your bookkeeping.
Metrics, logs and traces feed a private observability stack so we can detect and respond to incidents quickly.
Data protection & your rights
Your data is stored in the EU, and we follow the GDPR principles of minimisation and purpose limitation. You can edit your records and export your documents at any time; the full ledger export is included in the Pro plan and above.
You can close your account yourself, from Settings → Security. It is deactivated on the spot — sessions ended, API keys and connectors revoked — and a one-time link, shown to you once, lets you undo that for 30 days. Closing your account does not close your company: its books, its documents and any subscription continue, and someone else has to take them over or close them separately. The scheduled erasure that follows the grace period is built but not switched on yet, because the retention periods it must respect are still being settled: until it is on, a closed account stays deactivated and you can write to contact@qontab.com to have the data erased by hand. Your accounting records are kept either way, as the law requires.
Our Privacy Policy covers the detail. Our list of sub-processors and our data-processing terms for business customers are available on request.
What we're working on
Security is never “done”. These are the next improvements on our roadmap — listed here openly rather than hidden:
- Off-host, encrypted backups with regularly tested restores
- Database-level Row-Level Security as a second layer beneath our application isolation
- Dropping banned IP addresses at the firewall too (our edge proxy already refuses them)
- Tightening our Content-Security-Policy further
- Independent penetration testing, and working toward SOC 2 / ISO 27001 readiness as we grow
Found a vulnerability?
We welcome responsible disclosure and will not pursue legal action against good-faith researchers. Please give us a reasonable window to fix an issue before disclosing it publicly, and never access or destroy data that is not yours.
Email security@qontab.com. Our machine-readable contact is published at /.well-known/security.txt.