Verified, not assumed
How we actually protect your data.
Backbrief is pre-launch and can't yet afford a formal SOC 2 audit. Here's what's actually built, tested against the real running system, and dated - plus an honest account of what isn't done yet.
Checked against the running system
Five things we can prove, not just promise.
Each of these was verified directly against production on 2026-07-28 - not read off a design document, and not assumed from how the system is supposed to work.
No one reads your data as a matter of routine.
Our software reads your data; our people can't. The encryption path runs continuously in production - not a one-time setup, an always-on structural guarantee that fails the whole system rather than quietly falling back to something weaker. Separately, the one identity with administrative access to the encryption key was tested directly against it and denied: administration and decryption are held by different identities, and neither can do the other's job.
Your records can't be silently altered.
The history is append-only, enforced at the database level - not by policy, not by convention. We didn't take the configuration's word for it: we directly attempted to alter and to delete a record through the same database role the running application uses, and both attempts were refused outright.
Our AI proposes. It never rewrites your books.
The role that reads your business signals to draft suggestions has no ability to write to your actual records at all - it can only place a candidate in a separate queue for confirmation. We tested this the same way: attempted a direct write as that role, and it was refused. You and your own systems are what establish the truth, always.
A stolen copy of our database shows no amounts.
Invoice and payment amounts are encrypted with your own key before they reach the database. We proved it the only way that counts: took a real dump of the production database and read it. Every amount was ciphertext; none was a readable number. See the caveat below about older backups - we tell you that rather than round it up.
Your data lives in the EU.
Application data is hosted in Helsinki, Finland. Encryption-key custody sits separately, in Frankfurt, Germany. Two different providers, two different countries, so that no single party holds both your data and the key to it.
Where we actually stand
We're not SOC 2 certified. Here's why, and what we've done instead.
What we have done: the system is architected around per-tenant encryption, zero standing human access, and an evidence model that keeps your data in your own systems. We have run our own security testing and built automated cross-tenant isolation checks that run on every change to the code.
What we have not done yet: an independent senior code review, and a third-party penetration test. Both are funded by early customer revenue and scheduled - the code review before we take on customers beyond our first cohort, the penetration test after that.
Why we're telling you: because you'd be taking a risk on an unproven product, and you should know exactly what that risk is - not read it off a badge we don't have yet.
The architecture underneath
Per-tenant encryption, down to the amounts.
Every customer gets their own encryption key, wrapped by a root key held in a separate country from the data. It protects your QuickBooks connection token and, since 2026-07-28, the financial amounts in your history as well.
We verified it the hard way. Rather than trust the design, we took a real dump of the production database and read it: every amount appears as encrypted ciphertext, none as a readable number. Due dates and currency codes stay readable on purpose - encrypting them would protect nothing and break how the product works. One honest caveat: backups written before that date are locked for 30 days and still contain readable amounts until 2026-08-27. The Privacy Policy says why we can't delete them early.
Full detail on this, disk-level encryption, retention, what happens when you cancel, and exactly what we access and why is in the Privacy Policy.