Security & trust
Your financial security matters. Here's exactly how we protect it.
- TLS 1.3 in transit
- AES-256 at rest
- Read-only via Plaid
- SOC 2-aligned infrastructure
- GDPR & CCPA compliant
Why security matters more for bookkeeping software
Unlike a general-purpose app, bookkeeping software holds your bank details, income records, expense history, invoices, and receipts. A breach here doesn’t just leak data — it can expose your business to fraud, financial loss, and regulatory trouble.
That’s why we treat security with the same rigor major financial institutions do. Tabby is built for fintech from day one — not a spreadsheet tool that added a login screen later.
The short version
Four layers standing between your data and anyone who shouldn't see it.
Encrypted, always
TLS 1.3 protects data in transit; AES-256 protects it at rest — the same standards used by major banks and the U.S. government.
Read-only bank access
Tabby connects to your bank through Plaid. Your credentials never touch our servers, and we can only view transactions — never move money.
Access controls built in
Multi-factor authentication, role-based permissions for your team, and session timeouts keep your account yours alone.
Independently audited
Quarterly security audits, annual penetration testing, and continuous vulnerability scanning — done by third parties, not just us.
01 — Encryption
Data encryption — in transit and at rest
In transit. When you use Tabby or submit financial data, it travels across the internet encrypted with TLS 1.3 — the latest, most secure transport encryption protocol, secured by globally-recognized certificate authorities. Think of it as an encrypted tunnel: intercepted traffic looks like gibberish, not account numbers.
At rest. Once data reaches our servers, it’s protected with AES-256 encryption — the same standard used by the U.S. Department of Defense. Every transaction, invoice, receipt, and report is encrypted at the database level, before storage, not after. Encryption keys are stored separately from the data itself in a dedicated key management system that rotates keys automatically.
What this means for you: even if someone physically stole our servers, your data would be unreadable without the encryption keys — and those keys are hardware-protected and never stored in application code.
02 — Bank connections
Read-only connections through Plaid
Tabby never stores your banking username, password, or login credentials. Instead, we connect through Plaid, the financial data network trusted by major banks and fintech platforms.
- You connect directly to your bank through Plaid’s secure portal — not through Tabby.
- Your bank verifies your identity using its own official authentication methods.
- Plaid retrieves your transaction data and passes it to Tabby already encrypted.
- Your banking credentials never leave your bank and never touch Tabby’s servers.
The connection uses OAuth 2.0 and is read-only: Tabby can see transactions, but it cannot initiate transfers, payments, or account changes. Plaid itself is SOC 2 Type II audited.
Why read-only matters: even in the unlikely event Tabby's systems were compromised, no one could move money out of your bank account. They could only see transaction data.
03 — Access & authentication
Access control & authentication
Multi-factor authentication. We strongly recommend enabling MFA on your account — a second proof of identity beyond your password, via an authenticator app (Google Authenticator, Authy, Microsoft Authenticator) or SMS backup.
Role-based access. If you invite a team member or accountant, you control exactly what they can see:
| Admin | Full access to all features, settings, and billing. |
| Bookkeeper | Can categorize transactions, upload receipts, and generate reports — no billing or delete access. |
| Accountant | Read-only access to transactions and financial reports (used for Tabby for Accountants). |
| Custom | Define a custom permission set for your team's specific workflow. |
Session management. Inactive sessions expire after 30 minutes. You can view and revoke access from devices you no longer use, and review your login history at any time to spot unauthorized activity.
04 — Infrastructure
Infrastructure security
Tabby runs on Amazon Web Services (AWS), in SOC 2 Type II-certified data centers with geographic redundancy across multiple U.S. regions, 24/7 physical security, biometric access controls, fire suppression, and redundant power with automatic failover.
On the network side: multi-layer firewalls, DDoS protection via AWS Shield, real-time intrusion detection, and an isolated virtual private cloud (VPC) restrict who and what can reach our systems.
- Quarterly audits — third-party security firms review our infrastructure and code every quarter.
- Annual penetration testing — ethical hackers try to break in before bad actors do.
- Continuous vulnerability scanning — automated tools scan for known issues around the clock.
- 48-hour patch policy — security patches are applied to all systems within 48 hours of release.
05 — Application security
Application & API security
Our engineering team builds against the OWASP Top 10 — the industry-standard list of critical web vulnerabilities. Every input is validated and sanitized, output is encoded to prevent cross-site scripting, and database queries are parameterized to prevent SQL injection.
Tabby’s APIs require key-based authentication tied to a specific account, are rate-limited to prevent brute-force abuse, and restrict cross-origin requests (CORS) to authorized domains only.
06 — Compliance
Compliance & certifications
- SOC 2 Type II — annual audits verifying our security, availability, processing integrity, confidentiality, and privacy controls.
- GDPR — compliant with the EU’s General Data Protection Regulation.
- CCPA — compliant with the California Consumer Privacy Act.
- PCI DSS — Tabby doesn’t process cards directly; our payment processor, Stripe, is PCI DSS Level 1 certified.
International data transfers are protected under Standard Contractual Clauses. We retain only the data necessary to provide our service and comply with the law — see our Data Retention Policy for exact timelines, and our Privacy Policy for how we handle personal data.
Shared responsibility
What you can do to stay secure
01
Use a strong, unique password
02
Turn on multi-factor authentication
03
Keep your devices patched
04
Avoid public Wi-Fi, or use a VPN
05
Log out on shared devices
06
Monitor your account
If something goes wrong
Our security incident response
Containment
We immediately isolate affected systems to stop the incident from spreading.
Assessment & notification
Our security team investigates scope and impact. If your data was affected, we notify you within 24 hours with the details.
Forensics & remediation
We work with third-party security experts to understand how it happened, patch the underlying issue, and restore from clean backups if needed.
Ongoing communication
We provide regular updates through remediation, offer credit monitoring if personal data was exposed, and comply with all applicable breach notification laws.
Found a vulnerability? Report it responsibly to security@usetabby.com instead of disclosing it publicly — include a description, steps to reproduce, and potential impact. We investigate every report and may offer a bounty for valid, previously unknown issues.