Your books, kept confidential.
Qontab holds some of your company's most sensitive data. Here is exactly how we protect it — and an honest account of what we have in place today versus what we are still building.
Last updated: September 16, 2026
We don't oversell our security.
We are a young product. We are not SOC 2 or ISO 27001 certified, we do not yet commission third-party penetration tests, and we run on a single, hardened server in an OVHcloud data centre in France until our growth justifies more. We will never claim a certification we do not hold. Everything below is real and verifiable in our code and infrastructure.
Encryption
Every connection is encrypted with TLS — version 1.2 at minimum, 1.3 negotiated by any modern browser — and enforced at our edge with HSTS (one year, with subdomains and preload). Plain HTTP only ever redirects to HTTPS.
Sensitive stored secrets — such as the API keys for AI features — are sealed with AES-256-GCM authenticated encryption before they reach the database. The encryption key is kept in the server's environment, never in the database.
Tenant isolation
Qontab is multi-tenant, but your data is fenced off from every other customer. Only our API layer is allowed to touch the database, and it scopes every read and write to your company. Your membership of that company is checked on every request.
This isolation is enforced in application code, and it is tested. As defense-in-depth, we are adding database-level Row-Level Security underneath this application-level guarantee (see “what we're working on” below).
Authentication & access
- Sessions. Stored in HTTP-only, secure cookies — never readable by page scripts, never kept in localStorage where an XSS could steal them.
- Two-factor & passkeys. TOTP two-factor authentication and WebAuthn passkeys are available on every account.
- AI / MCP access. AI assistants connect through OAuth 2.1 with PKCE; access tokens are short-lived and scoped to read-only or read-write.
- API keys. Scoped, revocable, and they expire (after one year at most). We store only a SHA-256 hash and compare it in constant time; the secret is shown once and never recoverable.
- Role-based access. Every resource and action is gated by role (owner, admin, accountant, advisor, viewer), and unapproved accounts are blocked by default. You choose who you invite, with which role.
Infrastructure
Application containers run read-only, drop all Linux capabilities and cannot gain new privileges. The database, object storage and cache sit on internal-only networks with no public route.
Administration and dashboards are reachable only over our private Tailscale network — there is no public SSH. Our edge proxy blocks common scanners and abusive paths, and CrowdSec continuously analyses access logs for attacks.
Monitoring & audit trail
A tenant-scoped audit trail records who did what on your books — creations, edits, deletions, postings, approvals and team changes — with the actor, the time and the before/after state. Writing it never blocks your bookkeeping.
Metrics, logs and traces feed a private observability stack so we can detect and respond to incidents quickly.
Data protection & your rights
Your data is stored in the EU, and we follow the GDPR principles of minimisation and purpose limitation. You can edit your records and export your documents at any time; the full ledger export is included in the Pro plan and above. To close your account and have your data erased, write to contact@qontab.com — self-serve account deletion is not available yet.
Our Privacy Policy covers the detail. Our list of sub-processors and our data-processing terms for business customers are available on request.
What we're working on
Security is never “done”. These are the next improvements on our roadmap — listed here openly rather than hidden:
- Off-host, encrypted backups with regularly tested restores
- Database-level Row-Level Security as a second layer beneath our application isolation
- Enforcing automated IP bans at the firewall (attack detection is already live)
- Tightening our Content-Security-Policy further
- Independent penetration testing, and working toward SOC 2 / ISO 27001 readiness as we grow
Found a vulnerability?
We welcome responsible disclosure and will not pursue legal action against good-faith researchers. Please give us a reasonable window to fix an issue before disclosing it publicly, and never access or destroy data that is not yours.
Email security@qontab.com. Our machine-readable contact is published at /.well-known/security.txt.