Security overview
Your books contain some of the most sensitive information your business has. This page explains, in plain terms, how Bokapsys protects that information and which security settings are in your hands.
Your workspace is yours alone
Section titled “Your workspace is yours alone”Each workspace is kept separate from every other. Every request you make in Bokapsys is checked against the workspace you’re signed in to, so one workspace can never see or change another’s statements, reports, invoices or settings. This applies everywhere, including search, reports and Smart Chat.
If you belong to several workspaces, they stay separate too. Switching workspace changes everything you see; nothing carries over from one to the other. See Workspaces.
Signing in
Section titled “Signing in”-
Verified email addresses. A new account signed up with email and password has to confirm its email address before it can sign in.
-
Passwords. Passwords must be at least 8 characters and mix uppercase and lowercase letters, numbers and symbols. They’re never stored in readable form, and changing one requires a code sent to your email.
-
Google and Microsoft sign-in. You can sign in with your Google or Microsoft account instead of a password. Bokapsys only receives your name, email address and profile picture.
-
Two-factor authentication. Turn on two-factor authentication and every sign-in on a new device also needs a 6-digit code from an authenticator app on your phone. We strongly recommend it for everyone, and especially for anyone who can approve payments or change settings. You can also turn it on from Security (2FA) in the account menu at the top right. See Profile and sign-in.
-
Limits on repeated attempts. Bokapsys slows down repeated failed sign-in and password-reset attempts.
-
Session length. Your super admin decides how long members stay signed in, from 8 hours to 30 days, or until the browser tab closes. See Company settings.
Who can do what
Section titled “Who can do what”- Roles and permissions. Each member has a role, and each role allows a specific set of actions. Pages, buttons and data a member’s role doesn’t allow are hidden from them and refused if they try anyway. See Team and roles.
- Changes take effect straight away. When you remove or deactivate a member, they lose access immediately. When you change a role’s permissions, everyone who holds it has to sign in again so the new permissions apply at once.
- Smart Chat respects roles. Smart Chat works with the permissions of the person asking. It can’t show someone data their role doesn’t allow them to see.
- Approvals and separation of duties. You can require approval before money moves, and stop the person who created something from approving it themselves. See Approvals.
Your accountant’s access is your decision
Section titled “Your accountant’s access is your decision”An accounting firm can only work in your workspace after you approve its request. You choose exactly what it can do, and four things can never be given to an outside firm: deleting the workspace, managing API keys, managing your team and editing roles. You can narrow its access or remove the firm entirely at any time, and removal takes effect immediately. See Firm access.
Protecting your data
Section titled “Protecting your data”- Encryption in transit. All traffic between your browser and Bokapsys is encrypted.
- Encryption at rest for the most sensitive data. Credentials for your bank connections and mailbox connections, and the content of emails imported into the Inbox, are additionally encrypted with AES-256 before they are stored.
- Hosting. Bokapsys runs on Amazon Web Services (AWS) in the United States.
- Read-only connections. Your bank feeds can read transactions but can’t move money, and a connected mailbox can read mail but can’t send, change or delete it. See Data and privacy.
- Card payments. Online payments for your invoices and your Bokapsys subscription are processed by Stripe. Bokapsys doesn’t store full card numbers.
A record of every change
Section titled “A record of every change”The Audit Log in Team Management records changes made in your workspace: who did it, their role, when, and what they did. Entries can’t be edited. Your financial records are also protected in their own right: a mistake in a posted General Ledger entry is corrected by reversing it rather than by editing it away, so your books keep a record of what changed. See Team and roles and General ledger.
What you can do
Section titled “What you can do”Report a security concern
Section titled “Report a security concern”If you think your account has been compromised, change your password, make sure two-factor authentication is on, and contact us straight away. Use the same page to report a possible security issue in Bokapsys.