Compliance
Honest current state of Solid Accounting's compliance posture. We don't claim certifications we don't have; the table below is what we actually do today plus what's in flight.
At-a-glance
| Framework | Status | Notes |
|---|---|---|
| SOC 2 Type II | In progress | Type I observation period started Q2 2026. Type II expected Q1 2027. |
| GDPR | Compliant | Data export, deletion, and processing transparency in place. See GDPR page. |
| CCPA (California) | Compliant | Same controls as GDPR — California residents have equivalent rights. |
| HIPAA | Not applicable | Solid Accounting is general-purpose accounting software. We don't process Protected Health Information. If you're a healthcare practice, your bookkeeping (invoices, expenses, payroll) isn't PHI even if your clinical system is. |
| PCI-DSS | Not applicable | We don't process cardholder data. License sales and online invoice payments go through the payment provider (Stripe for license sales). Card numbers never reach our servers or your company file. |
| ISO 27001 | Considering | Customer demand-driven. If you need this, email us. |
| FedRAMP | Not applicable | Solid Accounting is desktop software, not a cloud service. |
What we mean by "compliant"
For frameworks where we say Compliant, we've implemented the controls, documented them, and would withstand an audit. We haven't paid for third-party attestation in every case.
For In progress, we're actively running the operational discipline (logs, reviews, evidence collection) against a controls list, with a third-party auditor engaged.
For Not applicable, the framework's scope doesn't include what Solid Accounting does. We say so explicitly rather than evasively.
Data residency
| Data | Stored where |
|---|---|
| Your company file | Your computer |
| Encrypted cloud backup (our storage) | Our cloud storage in the US; encrypted before upload, and we can't read it |
| Encrypted cloud backup (your own destination) | Your folder or S3-compatible bucket, wherever it lives |
| License records | Our license server (US) |
| Bank feed transactions | Our server and Plaid (US) |
| Invoices sent with Cloud Invoicing | Our server (US) |
For strict EU residency: choose your own EU bucket as the cloud backup destination, and don't turn on bank feeds or Cloud Invoicing. Your license record (name, email, license key) stays on our US license server. See Security → Where your data lives for the full list.
Vendor-risk-review packet
If you need a signed packet for a procurement review:
- Email
security@solidaccounting.comwith your procurement contact's name and the framework(s) involved - We send the most current security questionnaire fill (CAIQ, SIG-Lite, custom)
- Turnaround: 3-5 business days for standard packets; longer for custom requests
We don't charge for these.
Where we explicitly don't meet a bar
A few things to set expectations:
- No SOC 2 Type II yet — we're in observation. If your procurement requires existing Type II, talk to us; we may have remediation.
- No third-party penetration test on file — a quarterly external pentest is on the post-launch roadmap.
- No formal data processing agreement (DPA) signed individually unless you ask — our standard terms include processing terms; a signed DPA is available on request.
- No HIPAA Business Associate Agreement (BAA) — Solid Accounting isn't appropriate for files containing PHI even if BAAs were available. Use a healthcare-specific accounting product if you process PHI.
Reporting compliance issues
If you've identified a compliance gap or potential issue:
- Email
security@solidaccounting.com - Or use the contact form at solidaccounting.com/support
We acknowledge within 24 hours and treat compliance reports the same as security reports — see Security → Reporting a security issue.
Cross-references
- Security whitepaper — the technical security architecture
- GDPR compliance — EU-specific details
- SOC 2 status — current observation period