Security

• The website and AutoBooks are served only over HTTPS, with HSTS so browsers do not fall back to an unencrypted connection.
• Stored data and files are encrypted at rest by our hosting providers.
• Internal services such as the job queue have no public address.

• Each firm's or company's workspace is kept separate from every other customer.
• Roles limit what each person sees. Juniors see only their assigned clients, and portal users see only their own files.
• Uploaded files are private. Links to open them are short-lived and created only after AutoBooks checks who you are.
• AumBiz staff who operate the platform see usage and billing details, not your documents or transactions.
• An audit trail records important actions and corrections.

• Passwords are stored only as a one-way hash and checked against known breached passwords.
• New accounts confirm their email with a short-lived code.
• Repeated failed sign-ins are slowed down, and idle sessions end after about 30 minutes.
• You can sign in with Google or Apple instead of a password.

• Uploads are limited to known document and image types, up to 25 MB each, and file names are cleaned.
• Spreadsheet numbers are parsed by AutoBooks and are not sent to the AI reading service.
• Error reports are sent without document contents or session recordings.

• The AutoBooks Tally Connector runs on your computer and reaches AutoBooks over an outbound HTTPS connection. You never open Tally's port to the internet.
• Connector tokens are shown once, stored only as a fingerprint, and can be revoked.
• Card details are entered with our payment provider. AutoBooks never receives the full card number.

• Every change is checked for insecure code, vulnerable dependencies, and leaked secrets before release.
• Our own administrative accounts are protected with two-step verification.
• People who leave lose access promptly.
• Where data is stored, and which providers we use, is listed in our Privacy Policy.

Email support@aumbiz.com with the subject SECURITY. Include what you found and how to reproduce it. We acknowledge reports within two business days and keep you updated while we fix it. Please do not access other customers' data, run tests that disrupt the service, or publish details before we have fixed the issue.

Our contact details for researchers are also published at /.well-known/security.txt.