FinAccrual

Security at FinAccrual

Last updated: September 20, 2026

FinAccrual is a product of Aveera LLC, an Ohio limited liability company. FinAccrual prepares accrual, prepaid, and deferred-revenue journal entries in Microsoft Excel and posts them to your accounting system. Because that means acting on your accounting data, this page explains plainly how the service is secured and — just as importantly — how little of your data we keep.

1. What we store — and what we don't

Our database is deliberately minimal. It holds no journal amounts, no account balances, and no line-item detail.

2. How the QuickBooks Desktop connection works

• The add-in talks to QuickBooks Desktop on the same computer through the QuickBooks SDK, with the company file open. QuickBooks asks you, in its own permission dialog, whether to allow FinAccrual access; you can remove that permission at any time under QuickBooks’ integrated applications.
• FinAccrual’s servers prepare each QuickBooks request; Excel executes it locally through the QuickBooks Desktop SDK and returns QuickBooks’ reply to our servers to be read. Replies, including the full account and class lists returned by a sync, are parsed and handed back to the workbook; they are not retained.
• Our servers never hold a QuickBooks credential or token and never communicate with Intuit. What they hold is the company file’s identifier and display name, the workspace it belongs to, and which users may post to it.
• Every posting request is prepared and signed by our service for one specific company file, and the add-in checks it is talking to that file before anything is written. A workbook bound to one file cannot post to another.
• The workspace owner can disconnect a company file from the customer portal at any time; posting to it is refused until the owner reconnects it. The portal will not disconnect while a push is still in progress, so nothing in flight is lost.

3. Encryption

• In transit: all traffic uses HTTPS. The API enforces HTTPS-only with a minimum of TLS 1.2. Database connections require TLS.
• At rest: authorization tokens are encrypted at the application layer before storage. The underlying Azure database and storage are additionally encrypted at rest by the platform.

4. Authentication and access control

• Sign-in is operated by Microsoft Entra External ID. FinAccrual never handles your password.
• Every API request is authenticated with a signed token that is validated on the server. Endpoints that touch accounting data fail closed — if authentication cannot be verified, the request is refused rather than allowed.
• FinAccrual is multi-tenant with per-workspace isolation. Every query is scoped to the workspace derived from your token, so one customer's records cannot be returned to another.
• Posting is additionally gated on an active subscription; unauthorized or lapsed requests are rejected and recorded.

5. Safeguards on posting

Because FinAccrual writes to your books, the risky operation is posting — so it carries specific controls:

• Duplicate prevention. Each entry carries a deterministic identity; a repeated post of the same logical entry is detected and blocked rather than silently creating a second journal.
• Closed-period protection. Before posting, FinAccrual reads the book close date from your accounting system and blocks entries dated into a closed period. If that check cannot be completed, posting is blocked rather than assumed safe.
• Audit trail. Posting attempts, outcomes, and blocked attempts are recorded and visible to you in the customer portal.

6. Hosting and infrastructure

• FinAccrual runs on Microsoft Azure in the Central US region (United States). Application, database, secret store, and web front end are all hosted there.
• The database is a managed Azure Database for PostgreSQL instance. Public network access is restricted; it is not open to the internet at large.
• Secrets are held in Azure Key Vault and accessed via managed identity. No secret values are stored in our source code repository, which is private.
• Automated backups are retained by the platform, enabling point-in-time recovery.

7. Monitoring

• Application telemetry and server-side errors are collected through Azure Application Insights.
• Automated alerting notifies us of elevated server error rates so that failures are investigated promptly.
• Security-relevant events — sign-ins, connections, subscription changes, and blocked posting attempts — are written to an audit log.

8. Data retention and deletion

• Disconnecting your accounting system revokes the stored tokens and ends our access.
• You may request deletion of your FinAccrual account and associated records by contacting us at the address below. Because we do not retain your accounting content, deletion concerns your account identity, connection records, and posting references.
• Records of postings already made in your accounting system remain in that system and are governed by your provider and your own retention policies.

9. Service providers

We rely on a small number of established providers to operate the service: Microsoft Azure (hosting, database, secret management), Microsoft Entra External ID (authentication), Stripe (subscription billing — card details are handled by Stripe and never reach our servers), QuickBooks Desktop runs on your own computer, so Intuit is not a service provider to FinAccrual and our servers never communicate with Intuit.

10. Reporting a vulnerability

If you believe you have found a security issue in FinAccrual, please report it to support@finaccrual.com with enough detail to reproduce it. We will acknowledge your report, investigate, and keep you informed of the outcome. Please give us a reasonable opportunity to remediate before any public disclosure, and avoid accessing or modifying data that is not your own while testing.

11. Honest scope

FinAccrual is an actively developed product from a small company. We describe above the controls that are actually in place; we do not claim certifications we do not hold. FinAccrual is not currently SOC 2 or ISO 27001 certified. If your organisation requires specific assurances or documentation, contact us and we will tell you plainly what we can and cannot provide today.