Security

Written for the person
who has to approve it

You are being asked to put client tax records and financial documents into someone else's software. This page describes the controls that exist in the product today, in enough detail that you can ask us to prove any one of them.

If a control is not on this page, assume we do not have it yet. We would rather lose the deal than describe something we cannot show you.

Where your data lives

One region, named. No unexplained replicas and no per-tenant surprises.

Application
The Accute service runs on Google Cloud Run in a single region.
Region: us-central1 (Iowa, United States)
Every deploy is pinned to a specific build, tagged with the commit it came from
Traffic moves to a new revision only after a readiness check passes
Database
Firm data is held in a managed PostgreSQL instance in the same region.
Cloud SQL for PostgreSQL, us-central1
Reached over a private Cloud SQL connection, not a public IP
Schema changes run as a separate job before any traffic is shifted
Documents
Uploaded files go to a dedicated object storage bucket, not the app disk.
Google Cloud Storage bucket reserved for customer documents
Object paths are validated segment by segment before any write
Storage faults return a 503 rather than a silent partial save
Secrets
Credentials are injected at deploy time, never committed to the repository.
Google Secret Manager holds database and API credentials
Secrets are mounted into the runtime as environment values
The service refuses to start in production without a CSRF signing secret

Accute is served from the United States today. If your engagement letters or local regulator require data to stay in another jurisdiction, raise it before you sign rather than after. We will tell you plainly whether we can meet it.

Tenant isolation

The question behind every security review of a shared platform: can another firm ever see my clients?

One firm, one organization
Under the CAP gateway model every user belongs to exactly one organization, and that organization is their firm. There is no organization switcher to get wrong.
The organization is read from the user record on the server, not from the request
Cross-organization identifiers in a body, query or route parameter are rejected
Four parameter aliases are checked, so a renamed field does not slip through
Two layers, not one
Scope enforcement sits in application middleware, and PostgreSQL row level security policies back it on the workspace tables.
Row level security enabled on workspaces, user_workspaces and workspace_settings
Application middleware applies on top of that, so a query built by hand is still scoped
Requests that cannot be attributed to an organization are refused, not guessed

Encryption in transit and at rest

Named algorithms and named key custody, so your reviewer has something to check.

In transit
HTTPS only, with HSTS set to a one year max age, includeSubDomains and preload
Content Security Policy with default-src self, object-src none and upgrade-insecure-requests
Referrer-Policy strict-origin-when-cross-origin, X-Content-Type-Options nosniff
Session and CSRF cookies are httpOnly, secure in production and SameSite Lax
At rest
Stored credentials use AES-256-GCM authenticated encryption
Envelope encryption wraps each data key with a key encryption key held in Azure Key Vault
Data keys and key encryption keys are tracked in registries with their versions
Passwords are hashed with bcrypt at 12 rounds; MFA backup codes are hashed and single use
Values written under an older cipher are detected and re-encrypted to the current one

Access control and roles

Who can do what, how they prove who they are, and what stops a request that should not have been made.

Roles and permissions
Access is granted by role. Permissions are named individually rather than bundled into a handful of levels.
169 named permissions grouped into 30 categories
Permissions cover users, workflows, AI agents, documents, billing and administration
Role changes and permission grants are written to the audit trail
Sign-in and MFA
Staff sign in through the CAP gateway. Accute does not keep a second credential store for your team.
Time-based one-time password MFA with ten single-use backup codes
The TOTP secret is stored encrypted, never in plain text
Firms can set an organization-wide policy that requires MFA
Every request re-checks that the gateway session has not been revoked
Request hardening
State-changing requests have to prove where they came from before they are processed.
Double-submit CSRF tokens on POST, PUT, PATCH and DELETE
Origin and Referer validation on top of the token check
Rate limiting across the API, with tighter limits on sign-in and account creation
Dual control on key operations
Creating, rotating or revoking a key encryption key is not a single-admin action.
A quorum of approvals is required, two by default
Approval requests carry an expiry, so a stale request cannot be executed later
The initiator, the approvers and the outcome are all recorded

Audit logging you can verify

A log is only useful if you can tell whether someone edited it. These are hash chained, so a deleted or altered row breaks the chain.

LogWhat it recordsTamper evidence
Application audit trailSign-in and sign-out, MFA changes, role and permission changes, document access and sharing, exports, API key issue and revokeHash chained: each entry stores a SHA-256 hash of itself and of the entry before it
Cryptographic operationsEncrypt, decrypt, wrap, unwrap, rotate, create and revoke, with the actor, IP address and user agentSequence numbered and hash chained with SHA-512, with optional signing for non-repudiation
Encryption eventsWhich action ran, against which resource, and whether it succeeded or failedIndexed by timestamp, action and outcome for review
Credential accessReads and writes against stored third-party credentialsWritten on the same path as the operation, so a successful use cannot skip the log

Change management, backups and retention

How a release reaches you, and what happens to data after it stops being used.

Releases
Database migrations run as a separate job that must succeed first
A failed migration aborts the deploy and the previous release keeps serving
A readiness check that proves the database is reachable gates the rollout
Backups

Accute runs on managed Cloud SQL for PostgreSQL, so backup and point-in-time recovery are configured at the instance rather than in the application.

We do not publish the schedule or the recovery targets on this page. Ask for the current configuration in writing during procurement and we will confirm it before you sign.

Retention

Removing an installed AI agent keeps its data for a restore window, 90 days by default, before it is cleared. The reason and the person who removed it are recorded.

Retention for your firm's records at the end of a contract is set in the agreement, not by a default in the product.

Subprocessors

The third parties that can process firm data as part of running Accute.

ProviderPurposeWhere
Google CloudApplication hosting, PostgreSQL database, document storage, secret storageus-central1, United States
Microsoft Azure Key VaultHardware-backed key encryption keys for envelope encryptionConfigured per deployment
FinACEverse CAPIdentity gateway, subscription and billing. Operated by the same company as Accuteapp.finaceverse.io
FinACEverse Command CenterRoutes AI requests to the model provider configured for your firmcommand.finaceverse.io
Model providersOpenAI, Anthropic and Azure OpenAI, reached only through the router aboveProvider regions
ResendTransactional email such as notifications and invitationsProvider regions

Connectors you switch on yourself, such as an accounting ledger or a mail provider, add their own processor to this list for your firm only. The full current list, including anything specific to your configuration, is available on request.

Certifications

This page does not claim a certification for Accute. Plenty of vendors put an audit badge on a marketing page and hope nobody asks which entity and which scope it covers. We would rather you asked us directly.

Accute runs on Google Cloud and Microsoft Azure infrastructure that carries its own independent audits. Those are the providers' certifications, not ours, and inheriting infrastructure controls is not the same as being certified.

Our current certification and attestation status is available on request, under NDA, along with the underlying evidence. Write to security@accute.io and we will tell you exactly what is held and what is not.

Report a vulnerability

If you have found a weakness in Accute, tell us before you tell anyone else and we will work it with you. Send the affected URL or endpoint, the steps to reproduce, and what an attacker could reach.

Please do not run automated scans against production, and do not access, modify or retain another firm's data while testing. A single proof of access is enough.