Security
Your billing data, handled with care.
Pay apps, lien waivers and bank deposits are sensitive. Here’s how we protect them, in plain terms and without overclaiming.
Signed-in access only
Our billing desk sits behind Cloudflare Access. Only people we have named can sign in, and the desk checks every request against that list before it shows anything.
Encrypted, in transit and at rest
Every page, link and connection uses HTTPS. Bank connection tokens are encrypted with AES-256-GCM using a key kept outside the database.
Read-only bank access
If you choose to connect a bank account, it’s through Plaid and read-only: we see deposits so we can match payments to pay apps. We can’t move money.
We never ask for your passwords
Not for your bank, your email or your accounting system. Where a GC portal needs an upload, you upload the package or add us as a user you can remove at any time.
Signatures with an audit trail
Signing runs through BoldSign, which records who signed what and when. Signing links expire, and if the numbers behind a package change, the old link stops working and a corrected one is sent.
Every change on the record
The desk records what changed, when, and by whom. Updates from our providers — replies, signatures, bank activity — are accepted only with a valid cryptographic signature.
Only what billing needs
We collect what month-end billing requires and nothing more. Our website has no advertising trackers or third-party analytics.
Your records, your call
At the end of an engagement we return your records and delete them from our systems, except anything we’re required by law to keep.
Our providers
Established services, chosen on purpose.
We build on providers that specialize in security for their part of the job:
- Cloudflare — hosting, database, sign-in protection and network security.
- Quo (OpenPhone) — text messages, only to people who have opted in.
- Google Workspace — email.
- BoldSign — electronic signatures and signing records.
- Plaid — read-only bank connections, for clients who choose to connect.
- Anthropic — reading figures from photos and messages, with a person checking anything uncertain.
Each receives only what its job needs. See our Privacy Policy for how information is shared.
Straight answers
What we don’t claim.
We’re a small company. We don’t hold a SOC 2 report or a similar certification today. If your process includes a security questionnaire, send it to us — we’ll answer it in writing.
Found a problem?
If you think you’ve found a security issue in our website or desk, please tell us at [email protected] with “Security” in the subject. We’ll acknowledge it within two business days and keep you posted while we fix it. Please don’t access other people’s data or disrupt the service while testing.
Start here
Which GC held your last draw?
Tell us how many GCs you bill, what usually goes wrong, and when your next cutoff is. We’ll start by deciding whether this is the right problem to fix.