Security you can explain to your board.
Your ledger is the most sensitive data your company has. Here is exactly how we access it, protect it and keep AI agents inside the lines.
Access
We connect to your accounting system, banks and tools with read-only access wherever the provider supports it. Write access, for example to post approved journal entries, is opt-in, limited to the scopes it needs and logged.
- Single sign-on with Google or Microsoft, with MFA enforced for every user.
- Role-based permissions, so a board member can see the pack without seeing payroll.
- Access for our own team is granted per client, reviewed quarterly and removed the day someone leaves.
Data protection
Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Production systems run with a major cloud provider in the United States, with backups encrypted and retained for 30 days.
You own your data. Export it at any time, and when an engagement ends we return everything and delete our copies within 30 days, confirmed in writing.
AI governance
Agents propose; people approve. Every agent works inside the policies and thresholds agreed with you, and anything above those thresholds waits for a named person.
- Your data is never used to train AI models, ours or any provider's.
- We use AI providers under agreements that prohibit training on and retaining customer data.
- Every agent action is recorded with its inputs, sources and output, so you can audit any number back to the document behind it.
- A controls agent watches for unusual entries and segregation-of-duties breaks, including the other agents' work.
People and process
Everyone on our finance team is background-checked, signs a confidentiality agreement and completes security training at hiring and every year after. Client data is accessed only to deliver the service.
Compliance
Our controls are designed against the SOC 2 Trust Services Criteria. Contact us for our current compliance status, security questionnaire responses and subprocessor list.
Reporting an issue
If you believe you've found a security issue, email security@aicfo.pro. We acknowledge reports within two business days and won't take action against good-faith research.
Read-only by default
Write access is opt-in, scoped and logged.
AES-256 at rest
TLS 1.2+ in transit, encrypted backups.
SSO and MFA
Enforced for every user, including ours.
No model training
Your ledger never trains anyone's AI.
Full audit trail
Every human and agent action recorded.
Clean exit
Full export and deletion within 30 days.
See your numbers the way a CFO does.
Read-only access in. A written review of your books, cash and top risks out, within seven days.