How the documents are kept

This tool collects bank statements and tax documents. That is the entire reason the security design is described here in plain language rather than summarised as “bank-grade”.

The client link

A client link is a long random token. It grants access to exactly one request, and nothing else. It cannot be edited into a link for another client, another firm, or your dashboard — the server resolves the token to a single request before it does anything else, and refuses anything that does not match. That check is enforced by automated tests, not by convention.

A token is not an identity check, and we do not pretend otherwise: someone the client forwards the link to can open it. The trade is deliberate, because the alternative is a login the client will not use, and a document that is never sent is worse for you than one sent through a link.

Your access

You sign in with a one-time link emailed to you, not a password, so there is no password of yours to steal, reuse or forget. Sessions are short-lived. Uploaded files are downloadable only inside your signed-in session; a request for someone else’s file returns 401, and that behaviour is covered by the test suite.

Where files are stored

Outside the directory the web server can serve, under random filenames, so there is no URL that points at a document. Files are only ever handed out by the application, after it has checked who is asking.

Removed from search and from crawlers

Client pages, the dashboard and the billing pages are excluded in robots.txt, and the upload and dashboard routes are not linked from any public page. Client links are unguessable rather than hidden, so this is belt and braces rather than the defence itself.

Backups

The database and the uploaded files are backed up daily. The backup job opens the copy it made, runs an integrity check on it and counts the rows and files against the live database — and shouts if they disagree, because a backup that has never been read is a backup you do not have.

Deleting things

Ask and we delete the files themselves, not just the database row pointing at them. If you are a client of a bookkeeper using this service, ask the bookkeeper — they are the ones who asked you for the documents, and they control the account.

What this is not

It is not a system for regulated records retention, it is not e-signature, and it is not a replacement for your own professional obligations about how client documents are handled. It is a careful place to collect them.