Security Overview
Effective Date: October 2, 2026
Last Updated: October 15, 2026
Our Approach
FlashQofE LLC handles confidential financial information for accounting and advisory firms and their clients. This overview summarizes how we protect that information. Our internal Information Security Policy and related policies are available to customers under a confidentiality agreement.
Infrastructure
The Platform runs on established United States cloud providers, each of which holds its own independent security attestation:
| Provider | Role | Attestations |
|---|---|---|
| Vercel | Web application | SOC 2 Type 2; ISO/IEC 27001:2022 |
| Railway | API and processing services | SOC 2 Type II; SOC 3 |
| Supabase (on AWS) | Database and file storage | SOC 2 Type 2 |
Data Protection
- Encryption in transit: All connections use TLS 1.2 or higher.
- Encryption at rest: Data in the database and file storage is encrypted with AES-256.
- Customer isolation: Each firm's data is isolated by server-side authorization checks on every request, and row-level security is enabled on every database table as an additional layer that blocks direct access.
- Credentials: Connection credentials for third-party services are encrypted before storage.
Access Control
- Access to production systems and customer data is limited to authorized personnel with a documented need.
- Before receiving access, all personnel, whether employees or contractors, sign confidentiality agreements, complete security training and use unique accounts protected by multi-factor authentication.
- Administrative access to infrastructure providers requires multi-factor authentication. Multi-factor authentication is available to all Platform users.
- Access is reviewed monthly and removed within one business day when no longer needed.
Platform Controls
- Financial figures are calculated by deterministic code, and each figure records its source and calculation.
- Review decisions and signoffs are recorded, and locked versions cannot be changed.
- The Platform records user activity on each engagement.
- External AI tools connected by a customer can read only locked, signed figures.
AI Processing
AI-assisted features send only the content needed for each task to Anthropic. Anthropic does not use this content to train its models and deletes it within 30 days under its standard commercial terms. See our AI Use Statement at flashqofe.com/ai-use.
Secure Development
Every change to the Platform goes through a pull request with automated testing, secret scanning, source code security scanning and automated code review before it can be released. Production releases and database changes require approval, and production changes are logged and monitored.
Vulnerability Management
Application dependencies are monitored continuously for known vulnerabilities, source code is scanned on every change, and the running application is scanned regularly. Fixes are applied on a defined schedule based on severity. Infrastructure providers patch their platforms automatically.
Backups
Databases are backed up daily by our database provider, and backups are encrypted.
Incident Response
We maintain an incident response plan. If we confirm a security incident affecting a customer's data, we will notify that customer within 72 hours and keep it informed as we investigate and resolve the incident.
Monitoring
Application errors are monitored continuously, with sensitive fields and IP addresses removed from error reports. Our hosting providers monitor their infrastructure.
Compliance Program
Our controls are designed against the SOC 2 Trust Services Criteria. An independent SOC 2 Type II examination by a CPA firm is underway.
Reporting a Vulnerability
Please report suspected vulnerabilities to support@flashqofe.com with the subject line "Security Vulnerability Report," including a description, steps to reproduce and potential impact. We will acknowledge reports within 48 hours. Please do not access other customers' data or disrupt the Platform while testing.
Your Responsibilities
Users help keep accounts secure by using strong, unique passwords, enabling multi-factor authentication, keeping credentials confidential and reporting suspicious activity promptly.
Contact
Email: support@flashqofe.com
Company: FlashQofE LLC
Website: flashqofe.com
Location: Pennsylvania, United States