Security
The controls an auditor asks about, built in rather than promised.
This page describes what the system does today. Where something is a deliberate limit rather than a feature, it says so.
Separation of duties, enforced in code
The person who prepares an invoice cannot approve it. The person who records a payment cannot verify it. These are not settings an administrator can quietly switch off to save time - the actions refuse, every time, and the attempt is logged.
We are never in your money
Your clients pay into your own bank accounts, printed on your own invoices. We do not hold, route, or touch that money, which means there is no balance of yours for us to lose. The only payment we process is your subscription to us.
Tenant isolation at the query, not the check
Every database read and write filters by your organisation as part of the query itself, rather than fetching a record and then asking whether you should have seen it. A record ID belonging to another company behaves exactly like an ID that does not exist.
An append-only audit trail
Sign-ins, approvals, bank-detail changes, payment records, exports. Who did what, when, and from which address. There is no code path in the application that edits or deletes an audit entry.
In more detail.
Accounts and sessions
- Passwords hashed with bcrypt, never stored or logged in readable form
- Optional two-factor authentication using an authenticator app, with backup codes
- Sessions expire within 8 hours and are re-issued hourly while you work
- Changing your password immediately invalidates every other active session
- Session cookies are HTTP-only, so no script on the page can read them
The application itself
- Every server action re-checks permission and organisation for itself, rather than trusting the page it was called from
- Content-Security-Policy, HSTS, frame-denial and MIME-sniffing protection on every response
- Rate limiting on sign-in and registration attempts
- All traffic over TLS, with HTTPS upgrades enforced by header
Your data
- Money is stored as integers in minor units, so no rounding drift can be introduced anywhere
- Issued invoices are immutable - corrections happen through credit notes, leaving the original intact
- Invoice numbers are allocated inside a database transaction and are never reused
- Uploaded files are stored under a per-organisation prefix and cannot be deleted across tenants
- Self-service export of your organisation’s data, at any time, without asking us
What we do not claim.
We are not certified to ISO 27001 or SOC 2 for this product. The controls above are real and you can hold us to them, but they have not been audited by a third party, and we will not display a badge we have not earned.
Your data is hosted outside Nigeria, currently in the United States. If your organisation needs it held in a particular region, talk to us before signing up rather than after.
No system is unbreakable, and anyone telling you otherwise is selling something. What we can promise is that the boring controls are actually in place, that we will tell you plainly when something is not, and that if we get something wrong you will hear it from us first.
Found something, or need detail for a security review? billing@suwebatu.co.uk. We would rather hear it from you than read about it.
Start your free trial