Version 2026-08-03-v1
Security Overview
Last updated: 3 August 2026
This page summarises security practices for HisaBooks. It is a truthful product overview, not a certification, audit report, or guarantee of uninterrupted or risk-free operation.
1. Platform controls
- HTTPS is required for production access and secure session cookies are enabled where the request is HTTPS.
- Security headers are used on sensitive pages, including frame protection, content type protection, referrer controls, and content security policy controls.
- Database access uses prepared statements in the core application helpers and tenant-scoped queries are required for company data.
- CSRF tokens protect state-changing web forms.
- Output escaping is used on public policy, signup, checkout, settings, and admin surfaces.
- Backup, privacy-request, and closure workflows are documented so deletion is not performed blindly or without retention review.
2. Identity and access
| Area | Current control |
|---|---|
| Passwords | Password policy checks and password hashing are handled by the application authentication layer. |
| Company codes | Users authenticate within a company context so tenant data is separated by company code and server-side checks. |
| Roles and permissions | Company users receive role and permission checks before sensitive workspace actions. |
| Two-factor authentication | Time-based one-time password setup is available in company settings with QR-code enrolment. |
| Email verification | Signup email verification is required and unverified accounts receive in-app reminders and checkpoints. |
| Sessions and tokens | Web, mobile, desktop, reset, invite, and public-form tokens have scoped uses and revocation paths where supported. |
3. Desktop and mobile security
The desktop client connects to the HisaBooks API over HTTPS, restricts permitted document/API origins, and stores tokens with operating-system protected storage where available. Mobile apps use secure storage for session tokens and saved account profiles, support biometric unlock through the operating system, and keep offline action queues on the device until synchronised or cleared.
HisaBooks does not receive biometric templates. Optional permissions such as notifications, camera, photos, and files are requested for the related feature only.
4. Data protection and retention
- Customer workspace data is tenant-scoped by company code and access permissions.
- Payment card entry is handled by Stripe; HisaBooks stores Stripe references and billing state, not complete card numbers or card security codes.
- Privacy and deletion requests are reviewed through a verified workflow before account access is closed or data is removed.
- Some business, tax, payroll, billing, support, security, audit, and legal records may be retained where required.
- Backups are restricted and expire under the operational retention schedule described in the Privacy Policy and deletion runbook.
5. Monitoring, audits, and incident response
HisaBooks records operational and security metadata such as login attempts, session activity, important admin actions, privacy-request events, billing lifecycle events, delivery outcomes, and worker execution evidence. These records support troubleshooting, abuse prevention, customer support, legal retention, and incident response.
If a personal-data incident is confirmed, AARK will assess scope, contain the issue, preserve evidence, notify affected Customers and regulators where required, and provide information reasonably needed for Customers to meet their own obligations.
6. Customer responsibilities
- Use strong unique passwords and enable two-factor authentication for administrators and high-risk users.
- Keep company codes, usernames, password reset links, authenticator secrets, and devices confidential.
- Review users, roles, workspaces, and permissions regularly.
- Remove users, saved devices, and sessions promptly when a person leaves the company.
- Control exported files, downloaded PDFs, emailed documents, printed records, and customer-selected integrations outside HisaBooks.
- Do not enter unnecessary sensitive data into free-text fields or attachments.
7. Report a vulnerability
Report suspected vulnerabilities to support@hisabooks.com with the subject "Security Vulnerability". Include affected URL or app version, steps to reproduce, impact, screenshots or logs if safe, and your contact details. The current reporting rules, safe-handling expectations, and disclosure process are summarized in the Responsible Disclosure Policy.
Security contact discovery is also published at /.well-known/security.txt.
Do not access, change, download, delete, disclose, or disrupt another customer's data. Do not run destructive tests, denial-of-service tests, spam, phishing, social engineering, physical attacks, or tests against third-party providers. We will review good-faith reports and may request more detail before confirming scope or timing.