Security

Pinecrest Solutions Ltd · Version 2026-10-20 · Effective October 20, 2026

Your books are some of the most sensitive data a business has. This page summarises how we protect them, how to report a vulnerability, and what we do if something goes wrong. The full list of measures is in Annex 1 of our Data Processing Agreement.

How we protect your data

  • In transit and at rest: all traffic to the API, MCP server and console uses TLS. Databases and backups are encrypted at rest [CONFIRM WITH HOSTING PROVIDER].
  • Access: OAuth 2.1 with PKCE, short-lived access tokens, rotating refresh tokens, scoped and revocable personal access tokens, and login throttling.
  • Isolation: every request for books data is scoped to the authenticated user's entity.
  • Integrity: posted transactions are immutable and corrected only by reversal, and ledger entries are hash-chained so tampering can be detected.
  • Resilience: rate limiting, idempotent writes, regular backups and restore testing.
  • People: production access is limited to named personnel and protected by multi-factor authentication.

Keeping your account safe

  • Give each application or AI agent its own token with the narrowest scopes it needs, and revoke tokens you no longer use under Developers → Tokens.
  • Keep client secrets and tokens on servers, never in browser or mobile code or public repositories.
  • Review what agents post, and prefer draft transactions with human review for high-value work.

Reporting a vulnerability

If you believe you have found a security vulnerability, email security@microbooks.io with the details and steps to reproduce it. Our security.txt has the same contact details. We will acknowledge your report within 3 business days and keep you updated.

When researching, please:

  • test only against accounts and entities you own;
  • do not access, change or delete other customers' data, and stop if you encounter any;
  • do not run denial-of-service, spam or social engineering tests;
  • give us reasonable time to fix the issue before disclosing it publicly.

We will not take legal action against research done in good faith under these rules. We do not currently run a paid bug bounty, but we are happy to credit researchers.

If there is an incident

  • We follow a documented incident response process covering detection, containment, investigation, recovery and post-incident review.
  • If a personal data breach affects your data, we notify affected customers without undue delay, and in any case within 48 hours of becoming aware of it, so that you can meet your own obligations.
  • Where we are the controller, we notify the Office of the Data Protection Commissioner within 72 hours as the Kenya Data Protection Act requires, and other regulators and affected individuals as their laws require.
  • Service status and incident updates are published at [STATUS PAGE URL].