Invited in, scoped to one organisation, recorded on the way through.

Invitation-only sign-in

Accounts exist only by invitation from an organisation admin, and invitations expire. Sign-in is email and password, with each session token verified by Google Identity Platform.

Nine permissions, checked on every request

Each role grants some of nine permissions, from viewing dashboards to approving adjustments. The server resolves the caller’s membership and checks the permission before it reads or writes anything; a missing permission is a refusal, not a hidden button.

One organisation per request

A membership belongs to exactly one organisation, and every read and write carries that organisation’s id. Companies inside it keep their own uploads, mappings, reconciliations and reports.

Share links that expire, revoke and hash

A pinned link shows one report from one upload of one company. The token is stored hashed, the link expires, and revoking it keeps the record while the page stops serving. The shared page sends no referrer, so the token cannot travel to a site the reader clicks through to.

Append-only trails

Every ledger-to-MIS-head change is recorded and never edited. Adjustments run maker-checker, and approving one is a separate permission from making one.

Fin is off until an admin turns it on

AI analysis is disabled for every new organisation until an admin enables it. It answers only from reconciled figures, and every question is logged with who asked it, readable by the organisation’s admins.

Hosting, encryption at rest and backups are properties of a deployment and are agreed per customer. This page states only what the product itself enforces.