Security

Everything travels over TLS. Nothing in CubeBooks is served over plain HTTP, and the mobile apps refuse an untrusted certificate rather than falling back.

At rest, the database and the file storage holding your receipts and documents are both encrypted with AES-256 by our hosting provider.

Access is enforced in the database itself, not only in the application. Every table has row-level security switched on, and the policies on them are written against your company membership — so a request for a row belonging to a company you are not a member of returns nothing, regardless of what the client asks for.

This matters because it means a bug in a screen cannot become a data leak: the screen is not the thing deciding what you may see.

We never see your card. Payment details go from your browser to Stripe, a PCI-DSS Level 1 provider, and what reaches us is a token that can be used to charge the subscription and for nothing else.

Bank connections go through Plaid. Your banking credentials are entered on Plaid’s own screen and are never transmitted to or stored by us; what we receive is read-only transaction data.

Administrative access to production is limited to the engineers who need it to operate the service, protected by multi-factor authentication, and used for operating the platform — not for reading customer books.

If you raise a support ticket that needs us to look at your data, we will ask you first.

Passwords are hashed, never stored in a form we could read, and never sent to us in a support email — if anyone asks you for your CubeBooks password, it is not us.

Team members are invited with a role, and roles are enforced server-side: an accountant cannot change your billing, and a viewer cannot post an entry.

The database is backed up daily and supports point-in-time recovery within a 7-day window. Backups are encrypted and are kept for 35 days.

You can also take your own copy at any time: Settings has a full export of your company’s data in an open format.

Write to security@cubebooks.ai. We will acknowledge within two business days and keep you updated until it is closed. We will not take legal action against anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before disclosing it.

Please do not test against another customer’s data, and do not run automated scans that would degrade the service for people using it.

CubeBooks is not SOC 2 certified and has not been through an ISO 27001 audit. We would rather say so than put a badge on this page that does not exist behind it.

If your organisation needs a formal attestation before it can use us, write to security@cubebooks.ai and tell us what you need.