Security

This is the page accountancy firms read before trusting you with client data. Being specific and honest beats being vague, and it answers most of a vendor security questionnaire before anyone sends one.

---

Security at CFO Pal Last updated: 22 August 2026

CFO Pal holds financial data on behalf of businesses and their advisers. This page sets out how we protect it, and states plainly where we are on certification.

Where your data lives

Your accounting data is stored and processed in the United Kingdom. Our database and our application compute both run in London.

Some supporting services sit outside the UK. Those handle email addresses, phone numbers, message content and billing details rather than your ledger. Every one is listed, with its location and transfer mechanism, at cfopal.co.uk/subprocessors.

Infrastructure

We do not operate our own servers.

Encryption

• In transit: TLS 1.3 with AES-256-GCM. TLS 1.2 is the enforced minimum.
• At rest: databases, backups and file storage are encrypted at rest by our infrastructure providers.

Keeping your data separate from everyone else's

This is the control that matters most in a multi-tenant financial product, so we are specific about it.

• Row-level security is enabled on every table containing customer data. Separation is enforced by the database itself, not by application code. A mistake in our application cannot expose one customer's data to another, because the database refuses the query regardless of what is asked.
• Access is resolved in one place. A single set of database functions determines which businesses a user can reach, covering ownership, account membership and team membership. Every table inherits from those functions rather than reimplementing the rule.
• Anonymous and authenticated database roles hold no blanket access to any customer data.
• Businesses within one account are separated from each other by the same mechanism, so a user with access to one business does not gain access to another.

Access control

• Two-factor authentication is available to all users.
• Team members can be granted read-only or read-write access, and that distinction is enforced at the database layer rather than hidden in the interface.
• Only the owner of a business can grant or revoke access to it.
• The full list of people who receive alerts for a business is always visible to that business. We do not support hidden recipients.
• Internal access to production data is limited to personnel who require it, uses unique named accounts, is reviewed on any change of personnel, and is revoked the day a person ceases to be engaged.

Your accounting connection

• We connect to Xero, QuickBooks and Sage through OAuth. We never ask for or hold your accounting platform password.
• Access is read-only.
• You can revoke our access from within your accounting platform at any time.

Backups and recovery

• Automated daily database backups, retained for 7 days, restorable to any retained day.
• Point-in-time recovery is not currently enabled, so recovery granularity is the most recent daily backup.
• Only regenerable content is held in file storage.

Logging and monitoring

• Administrative access to customer data is logged.
• Application errors are logged with alerting on failures.
• Infrastructure request and database logs are retained by our providers.

Development practices

• Production and development environments are segregated.
• Database schema changes are applied as versioned migrations.
• Row-level security is enabled by default on newly created tables.

Incident response

If we become aware of a personal data breach affecting customer data, we notify affected customers without undue delay and in any event within 48 hours. That commitment is contractual and sits in our Data Processing Agreement.

Our notification describes what we know about the nature of the breach, the categories and approximate number of records affected, the likely consequences, and what we are doing about it.

AI

CFO Pal's AI explains your numbers. It does not produce them. Every figure is calculated by our own deterministic engine; the AI receives completed figures and is asked to explain them, so it has no opportunity to invent one.

Your data is never used to train any AI model, by us or by any provider we work with. Full detail at cfopal.co.uk/ai.

Where we are on certification

We state this plainly rather than leaving it to inference.

CFO Pal does not currently hold ISO 27001, SOC 2 or Cyber Essentials. We are a new company and have not yet been through those processes.

What we do have:

• Registered with the Information Commissioner's Office, registration ZC222112
• A published sub-processor list with locations and transfer mechanisms
• A Data Processing Agreement setting out our obligations, available at cfopal.co.uk/dpa
• Infrastructure providers that hold ISO 27001 and SOC 2 Type II
• The technical controls described on this page, which are implemented and verified rather than planned

Independent penetration testing has not yet been carried out.

We will update this section as our certification position changes rather than removing it.

Reporting a security issue

If you believe you have found a vulnerability in CFO Pal, email security@cfopal.co.uk.

Please give us reasonable time to investigate and fix an issue before disclosing it publicly. We will acknowledge your report and keep you updated. We will not pursue legal action against researchers who report issues in good faith and do not access, modify or delete data belonging to others.

---