Your clients trust you with their books. You can trust us with them.
FynOps holds financial data for accounting firms and the businesses they serve. This page explains how we protect it, what we have in place today and where our compliance program stands.
Last reviewed October 27, 2026
SOC 2 program underway
Covering the Security, Availability and Confidentiality criteria.
Encrypted end to end
TLS in transit, encryption at rest, and an extra AES-256-GCM layer for connection credentials.
Isolated by design
Every data operation is scoped to your workspace and the companies you are allowed to see.
Compliance
SOC 2
We have started our SOC 2 program, covering the Security, Availability and Confidentiality Trust Services Criteria. We will update this page as each report is issued. We will not display a badge until we have earned it.
Reviewing FynOps for your firm? Send your security questionnaire to security@fynops.com and we will complete it, along with any vendor review documentation your process requires.
How we protect your data
Infrastructure
FynOps runs on Google Cloud, with financial graph data in Neo4j Aura.
- Production and development run in separate Google Cloud projects.
- Application services accept traffic only through the Google Cloud load balancer, protected by a Cloud Armor web application firewall.
- Physical security of data centers is provided by Google Cloud and Neo4j, which maintain their own independent security certifications, including SOC 2.
- Container images are built by a dedicated CI service account and deployed by commit SHA.
Data encryption
Your data is encrypted whenever it moves and wherever it is stored.
- All traffic uses HTTPS (TLS), with HTTP Strict Transport Security on the app.
- Data is encrypted at rest in Google Cloud and Neo4j Aura.
- Tokens for your connected systems (QuickBooks, Xero, banks, commerce and more) are additionally encrypted with AES-256-GCM before storage.
- Platform secrets are held in Google Secret Manager, never in source code.
Tenant isolation
Isolation between firms, and between clients within a firm, is the core of the platform.
- Every data operation is scoped to a workspace and, where applicable, a single company.
- Role-based access control is enforced on the server, not only in the browser.
- Automated tests exercise each role against each data scope so a permission change cannot silently widen access.
- Seeing a company in a list never implies access to its data.
Access and authentication
Accounts are protected at sign-in and throughout the session.
- Authenticator-app (TOTP) two-factor authentication for administrators.
- Browser sessions end after one hour of inactivity and reset every night.
- Disabled, revoked or deleted accounts are refused on their next request, within 60 seconds.
- Verification codes are hashed, single use and limited to five attempts.
AI data protection
You decide what an AI model is allowed to see.
- Optional data masking replaces bank account, routing, card, SSN and EIN numbers, personal emails and phone numbers with encrypted tokens before a request reaches a model.
- Masking policies are set per workspace and per company, and individual users can only tighten them.
- Every masked call is recorded in an audit your admins can review and, if needed, erase.
- FynOps uses AI models from Google, Anthropic, OpenAI and AWS.
Changes to your books
Your accounting system stays the source of truth.
- Every change the FynOps assistant or a connected AI client proposes to your accounting system is recorded as a change set with before and after values.
- Change sets follow your approval settings and can be undone.
- Changes dated in a closed and attested period are refused.
- Changes are deduplicated and checked for conflicting edits before they are applied.
Application security
The platform is hardened against common web attacks.
- Security headers on the app, including a Content Security Policy, frame blocking and MIME sniffing protection.
- A strict cross-origin (CORS) allowlist.
- Request guards for body size, path traversal, null bytes, content type and timeouts.
- Signature verification on incoming webhooks from connected providers, and identity checks on internal scheduled calls.
Availability
FynOps is built to stay up while your team works and while it sleeps.
- The production API always runs at least two instances and scales automatically with demand.
- Health probes replace unhealthy instances, and graceful shutdown lets in-flight requests finish.
- Excess load is shed before it can take the service down.
- Incidents are followed by a written postmortem and corrective actions.
Data retention and deletion
You can leave and take your data with you.
- Workspace owners can delete an account or an entire workspace from the app.
- Deletion runs a verified purge of workspace data.
- Audit history kept after deletion is anonymized, so it no longer identifies you.
- See our Privacy Policy for how long each type of information is retained.
Subprocessors
These companies process customer data on our behalf to deliver FynOps. Connected systems you choose to link, such as your accounting software, are not subprocessors: data moves between FynOps and them at your direction.
| Subprocessor | Purpose |
|---|---|
| Amazon Web Services (Bedrock) | AI models |
| Anthropic | AI models |
| Decodo | Network proxy for browser automation traffic |
| GitHub | Source code and error reports |
| Google Cloud and Firebase | Hosting, databases, storage, authentication and AI models |
| Loops | Product and newsletter email |
| Mailgun (Sinch) | Transactional email |
| Neo4j Aura | Graph database |
| OpenAI | AI models |
| Plaid | Bank connections |
| Stripe | Billing and payments |
Report a vulnerability
If you believe you have found a security issue in FynOps, email security@fynops.com with the steps to reproduce it. We will acknowledge your report, keep you updated while we investigate and credit you if you would like.
Please give us a reasonable time to fix the issue before disclosing it, and do not access, change or delete data that is not yours, or degrade the service for others.
Email the security team