Enterprise Security

Security & Compliance

SyncBook is built with security-first architecture. Every layer of the system — from authentication to database queries — is designed to protect your clients' financial data.

Authentication & Session Security

JWT access tokens (15-minute expiry) + refresh token rotation
bcrypt password hashing (cost factor 12)
Brute-force protection: 10 login attempts per 15 minutes per IP
Session invalidation on logout across all devices
httpOnly, Secure, SameSite=Strict cookie flags

Transport & Network Security

HTTPS enforced on all connections (TLS 1.2+)
Helmet.js security headers (HSTS, X-Frame-Options, CSP, X-Content-Type-Options)
CORS policy: only trusted origins allowed
Global rate limiting: 200 requests per 15 minutes per IP
Payload size limits: 50MB maximum per request

Data Isolation & Multi-Tenancy

Every database table includes firm_id — complete tenant isolation
All queries filtered by firm_id at the ORM layer
No cross-tenant data leakage possible by design
Parameterised queries throughout — no SQL injection risk
Least-privilege database user (SELECT, INSERT, UPDATE only)

Audit Trail & Compliance

Append-only audit logs — records are never updated or deleted
Every financial action logs: user_id, role, IP address, timestamp
Before/after values stored as JSON for every change
Document workflow state transitions fully tracked
Compliant with UK accounting record-keeping requirements

AI Microservice Security

Python ML service is internal-only — not exposed to public internet
API key authentication required for all ML service calls
Request validation and payload size limits on ML endpoints
Timeout handling prevents resource exhaustion
Separate process isolation from main application

Fraud Detection

Unusual login pattern detection (multiple failed attempts, new locations)
Abnormal transaction change detection
Bulk export monitoring
Benford's Law analysis on invoice amounts
Z-score anomaly detection on transaction values

Regulatory Compliance

SyncBook is designed to meet UK regulatory requirements for accounting software.

UK GDPR

Data minimisation, purpose limitation, right to erasure support

HMRC MTD

VAT returns generated in Making Tax Digital compatible format

UK GAAP

Financial calculations follow UK Generally Accepted Accounting Principles

ISO 27001 Principles

Information security management aligned with ISO 27001 framework

ICAEW Standards

Document retention and audit trail requirements met

Security Architecture

Component	Security Measures
Node.js Backend	JWT + refresh rotation, bcrypt, RBAC on every route, rate limiting, Helmet.js, CORS, parameterised queries
Python ML Service	Internal-only (not public), API key required, payload size limits, timeout handling, request validation
Electron Desktop App	DevTools disabled in production, encrypted local token storage, auto-update signature verification
Client PWA	JWT in httpOnly cookie, no sensitive data in localStorage, HTTPS enforced
Database	Parameterised queries, firm_id isolation on every query, least-privilege DB user
Audit Layer	Append-only logs, every financial action tracked, before/after values, IP address logging

Your clients' data is safe with SyncBook

Download SyncBook and start processing documents securely.