Security · Finstory FVQ

Your data stays yours.

Finstory FVQ processes the accounting data you or your Finstory contact upload solely to build your reports. It isn't sold, shared with other clients, or used to train anything. Every client's data is kept in its own isolated space, and every request is checked against who's actually logged in before anything is returned.

Access & authentication

Every account (client and staff) is isolated - a request for one client's data is checked against the logged-in user's own client ID on every single request, not just at login.
Role-based access: client accounts, owner accounts and admin (staff) accounts see different things by design.
Suspending a client's account cuts off their access immediately, including sessions already logged in - not just future logins.
Resetting a password immediately invalidates every existing session for that account.
Repeated failed login attempts are logged and rate-limited.
Multi-factor authentication (MFA) is already in place for our internal staff accounts.
MFA for client accounts - on our roadmap.

Application security

All data-changing requests are protected against CSRF (cross-site request forgery).
Session cookies are HttpOnly (invisible to page scripts) and use SameSite protection.
A strict Content-Security-Policy, plus standard hardening headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), are sent on every response.
Every uploaded file is checked against an allowed-type list, size-capped, and scanned for embedded script content before it's ever stored.
Uploaded Excel files are verified to actually be valid Excel files (not just renamed), not merely trusted by extension.

Data in transit

The site is served over HTTPS, with HTTP Strict Transport Security (HSTS) enforced.

How your reports get to you

A fresh upload always resets that report to a pending-review state - nothing reaches your login until a member of the Finstory team has reviewed and approved it.
Every month's reports are kept, not overwritten - you can always look back at a prior month exactly as it was approved.
Typical turnaround: your reports are ready within 3 hours of your accounting data being shared with us.

What we're still building

We'd rather tell you what's on the roadmap than overstate where we are today:

Multi-factor authentication (MFA) for client accounts (already in place for staff).
A published, independently reviewed incident-response process.
A third-party security review / penetration test as we scale.

Found a security issue?

If you believe you've found a security vulnerability in Finstory FVQ, please tell us directly rather than disclosing it publicly.