Security

Where data is stored

Records are stored in a managed PostgreSQL database in London, United Kingdom, encrypted at rest, with daily backups. All traffic uses HTTPS, and browsers are told to use HTTPS only.

Separation between organisations

Every query is checked by the database itself against the signed-in user's memberships, so one organisation cannot read or change another's records even through the API. These rules are covered by automated tests that run on every change.

Roles and approvals

• Each member has a role: owner, admin, finance, HR, procurement, accountant, auditor, viewer or donor view.
• Read-only roles cannot change records, and pay data is limited to payroll roles and auditors.
• Requisitions and purchase orders cannot be approved by the person who raised them.
• Your organisation can require a second person to approve journals before they are posted.

A ledger that cannot be rewritten

Posted journals and their lines cannot be edited or deleted. Mistakes are corrected with a reversing journal, closed periods cannot be posted to, and every posting, approval and period change is written to an audit log with the person and time.

Signing in

Passwords are stored only as hashes. Two-factor sign-in with an authenticator app is available to everyone, and owners can require it for all members or for owners and admins. FinNGO staff need two-factor sign-in to reach the administration portal.

Payments

Payments are taken by our payment provider. Card and bank details never reach FinNGO, and payments are confirmed with the provider before any access is granted.

Reporting a vulnerability

Email security@finngo.app with details and steps to reproduce. Please give us a reasonable time to fix the issue before disclosing it, and do not access other organisations' data while testing.