Security

This page is written for the person who has to approve a new tool inside their company. It says what we do, how it can be checked, and — just as important — what we do not have. A security page without that third chapter is not a security page; it is an advert.

Where the data lives

The application and the database run on a dedicated server in Romania, with a Romanian provider. Backups follow the same regime, with the encryption keys kept separately. Your data does not leave Romania as part of normal operation; when it does, it is because you connected something — the tax authority, a bank, a courier — and only what that service needs is sent.

Who gets into the account

• Two-step verification, four methods: passkey (fingerprint or face), authenticator app, email code, or PIN — presented strongest first, and labelled honestly.
• It can be enforced company-wide. The owner turns it on once.
• Alert on sign-in from a new location, by email, immediately. It does not block — deliberately: an automatic block locks people out the day they change internet provider.
• Trusted devices, revocable from anywhere.

What is encrypted beyond the connection

Traffic is encrypted, obviously. The question that matters to a large client is what is encrypted in the database, so that a backup in the wrong hands is not a breach: employees' national ID numbers, and every connector credential — tax portal, invoicing providers, accounting systems, couriers, online shops, time-tracking platforms. The keys that do the encrypting are themselves encrypted, with a certificate that does not live in the database. That last part is the one that counts: keys stored next to the data make encryption a gesture rather than a measure.

Bank statements

We do not connect to your bank: you download the statement from internet banking and upload it, we ask for no access to the bank account and send nothing to the bank. The file does not stay on the server — only its transactions are kept (date, amount, counterparty, their IBAN and tax ID, the description and the bank's reference), as much as is needed to match payments to invoices and to keep the same statement from coming in twice. Nothing is marked paid on its own: the app proposes, a person confirms, and every confirmation can be undone and leaves a trace in the audit trail. A statement can be removed at any time, with its transactions, as long as it has no confirmed matches.

Separation between companies

The answer is not „we are careful”. Every query carries the company filter by construction, and writing into a company other than the current one must be declared explicitly in code — otherwise a guard throws. That rule has its own tests, running on every change.

Who sees what, inside the company

Permissions are per action, not per screen. An automated guard checks on every change that an action which modifies data does not sit on a read permission — an easy mistake to make and impossible to spot by eye. An external accountant is granted access by the client, never the other way round, and it can be withdrawn at any time.

Audit trail and backups

Who did what and when is recorded for the operations that matter, and is readable from the application. Backups run hourly, not daily: the maximum loss in an incident is an hour of work. Restoration has been rehearsed, not merely configured — and the rehearsal changed three things in the procedure, which is precisely why it is done. A database copy without the encryption keys is not a copy; the keys are part of a recovery kit kept separately.

How we work

Over 1,500 automated checks run on every change. Some of them do not test features but rules: that no undeclared anonymous endpoint exists, that every action sits on the right permission, that no company can write into another. Security audits are periodic and written up, including the unpleasant findings. Every fixed defect gets a guard that fails if it comes back.

What we do NOT have

• No ISO 27001 or SOC 2 certification. If your organisation requires one as a condition, this page cannot replace it — tell us and we will discuss what we can document.
• No external penetration test. The audits are ours: rigorous, but ours.
• No 24/7 support. We answer during working hours.
• Some connectors can run simulated, depending on configuration — and where they do, the application says so on screen and refuses to start in production without explicit approval. A module that pretends to send is more dangerous than one that is missing.

If you are evaluating us right now

Send your questionnaire to andrei.bogdan@aynsoftsolution.ro. We answer point by point, including „we do not have that” where it applies.