Security

This page answers "how do you keep our books safe?" for owners, IT staff and auditors. It says what we do, what we don't try to do, and which data leaves your computer when you turn on an optional service.

For a vendor-risk questionnaire, email support@solidaccounting.com.

Where your data lives

Solid Accounting is desktop software. Your company file is on your computer, and the app doesn't need a constant internet connection. Some optional services send data to our servers or to a provider; each is listed here.

If you use none of the optional services, your accounting data stays on your computer.

Encryption

Company file. Every new company file is a SQLCipher-encrypted database (AES-256). It is keyed with a random 256-bit key, not with a password you type. The key is stored two ways:

• in your operating system's keychain (Windows Credential Manager or the macOS Keychain), so the file opens without a prompt on your computer. On a Mac the key is read once per session, and denying the keychain prompt stops it asking for that session;
• in a recovery file next to the company file, wrapped with a recovery phrase you choose or that the app generates (Argon2id, 64 MiB, 3 passes, then AES-256-GCM).

Keep the recovery phrase somewhere safe. You need it to open the company file on a new computer or after the keychain is reset. There is no back door: without the keychain entry or the recovery phrase, nobody, including us, can open the file.

Sensitive fields such as tax IDs and bank account numbers are also encrypted inside the file (AES-256-GCM).

Encrypted cloud backup. Before anything is uploaded, the app splits the file into chunks, compresses them (zstd) and encrypts each chunk with AES-256-GCM and a fresh random nonce. The chunk key is random, generated on your computer, and wrapped with a key derived from your password (Argon2id, 256 MiB, 3 passes). From version 26.10 the chunk key is derived from a 12-word recovery phrase shown at setup; backups set up earlier show theirs as a 24-word phrase. The storage holds only ciphertext; neither we nor the storage provider can decrypt it. Details: Cloud Backup.

In transit. Connections to our license server, update server, cloud backup storage, Plaid and AI providers use HTTPS with your operating system's certificate store.

Access control and audit

Users. Each person gets their own user, password and role in Company → Users & Roles..., which shows a permission table for each role. Only Admins can create users, and the last Admin can't be deleted or demoted. Passwords are stored as Argon2 hashes. Changing your own password asks for the current one, and an Admin's password reset is recorded in the Audit Trail. After repeated wrong passwords, sign-in slows down — up to an hour, never a permanent lockout. See Multi-user.

Tax IDs. Contact lists and the 1099 Report show only the last four digits of an SSN or EIN. Seeing a full tax ID needs permission to edit contacts and is recorded in the Audit Trail.

Local REST API. On Professional and Accountant, the Local REST API Server listens only on 127.0.0.1, so only programs on the same computer can reach it. It can't be exposed to your network. Network sharing of a company file uses a separate listener that accepts only paired computers over authenticated TLS. Each API key:

• starts with tlk_ and is shown once; only a SHA-256 hash is stored;
• has its own Read / Write / Import permissions and rate limit;
• can be revoked any time from Settings → AI & Integrations;
• is recorded by name in the Audit Trail for every change it makes.

The API sends no CORS headers, so a web page in your browser can't call it. See REST API.

Audit Trail. Every change to your books is recorded in the Audit Trail (Company → Audit Trail), inside the encrypted company file. The log is append-only and tamper-evident: the database refuses edits and deletions of its entries, for every user including admins, and each entry is chained to the one before it by a hash, which Ledger Health checks. Refused actions (a missing permission, a blocked delete) are recorded too. Changes made by apps and AI assistants also appear in Company → Activity Log (AI & Integrations).

Updates and licensing

Signed updates. Every update is signed with our Ed25519 key. The public key is built into the app, and the updater refuses any update whose signature doesn't match, whether it was tampered with or corrupted in transit.

Signed licenses. The license server signs each license claim (Ed25519). The app checks the signature and that the claim belongs to this computer before it turns on any paid feature.

What we don't protect against

• A compromised computer. Malware running as you can read what you can read. Keep Windows updated, use antivirus, and lock your screen.
• Losing both keys. If the keychain entry is gone and the recovery phrase is lost, the company file can't be opened. The same is true of cloud backups without your password or the recovery phrase. That is the price of real encryption.
• Providers' own security. Bank feeds rely on Plaid, and your own AI assistant relies on its company. Read their policies.
• A malicious update from us. Signing stops anyone else from shipping one. It can't stop us, so we review every release before it ships.

Reporting a security issue

Email security@solidaccounting.com. We acknowledge verified reports within 24 hours and will credit you in the release notes if you'd like. We don't run a paid bug bounty.

The source code is not open. If an audit needs to verify a specific claim on this page, email us to arrange a controlled review.

Related

• Cloud Backup
• Audit Trail
• Multi-user
• Compliance
• REST API