Security

Encryption

TLS in transit, version 1.2 minimum and 1.3 by default (Let's Encrypt certificates), encryption at rest on the database host's disks, and Fernet encryption for sensitive fields such as exchange API keys.

Sign-in

Passwords hashed with Argon2id (OWASP parameters), two-factor authentication by app (TOTP, RFC 6238) or by a 6-digit email code, refresh tokens rotated on every use with reuse detection, progressive lockout after repeated failures.

Client separation

Every request is filtered by organisation in the application code, and your access is checked again on each request. PostgreSQL row-level security policies are already in place on the tables and will become a second barrier (see the roadmap below).

Audit log

Manual reclassifications, rules, clean-ups and fiscal-year locks go into an append-only log chained with SHA-256. The database refuses any edit or deletion of that log. Every exported FEC is archived with its SHA-256 fingerprint, checked again on each download.

Hosting in the European Union

Hostinger (France): website and application hosting. Supabase (Ireland (European Union)): database and files (receipts, FEC). The third-party services (email delivery, block explorers, prices) and what they receive are listed in the privacy policy, in French.

Compliance

Under the GDPR, TLM Solutions is the controller for accounts, security and billing, and processes your accounting data on your behalf under the data processing agreement annexed to the terms of sale. A breach that puts data at risk is reported to the CNIL within 72 hours and to the organisations affected.

Report a vulnerability

Write to contact@trotme.fr and describe how to reproduce it.