Your books, protected.

How your data is protected

All traffic between your browser and Sales Scribe is encrypted with HTTPS, and browsers are instructed to refuse unencrypted connections.

On top of that, personal information — names, email addresses, phone numbers, addresses and tax identifiers on customer, supplier and billing records — is additionally encrypted at the field level inside the database, as are any email-server credentials you configure. The encryption key is held outside the application code, and the application refuses to start without it rather than ever serving unreadable or unprotected data.

Passwords are never stored — only industry-standard one-way hashes. Automated checks in our build pipeline prevent personal data and secrets from being written to application logs.

One organisation cannot see another

Sales Scribe is built around organisations. Every record belongs to exactly one organisation, and every database query is automatically constrained to the organisation you are working in — the isolation fails closed: if the organisation context cannot be established, no data is returned at all.

A second, independent guard checks every write before it is saved, and an automated test suite exercises these boundaries on every build. Cross-organisation access exists only where you explicitly grant it (for example to your accountant — see below), and is fully recorded.

Who can sign in, and what they can do

• Registration requires a confirmed email address and a strong password; sign-in attempts are rate-limited and bot-protected.
• Two-step verification (authenticator app) is available to every user — and mandatory for accountancy-practice staff.
• Access inside an organisation is governed by roles built from fine-grained permissions, enforced on every action on the server — not just hidden in the interface.
• Sensitive operations — data export, account closure, deletion, personal-data erasure — require you to re-confirm your password even while signed in.
• Safeguards prevent accidental lock-outs and privilege escalation, including last-owner protection.

Accountant access is yours to control

If you work with an accountant or bookkeeping practice, their access is consent-based: it starts with an invitation or request you accept, is scoped by an access profile you choose, and can be suspended or revoked by you at any time — immediately.

Every action practice staff take in your books is recorded under their own name in your organisation's activity history, and practice staff must use two-step verification.

Auditability

• Significant actions — record changes, sign-in security events, access changes, exports, erasures — are recorded in append-only audit trails that the application itself is prevented from editing.
• Accounting entries follow double-entry principles: issued documents become immutable, corrections are made by explicit reversing entries, and an archived PDF of every issued invoice is kept exactly as it was sent.
• Audit history is retained for six years, and personal data inside audit entries is redacted or anonymised in line with our retention policy.

Uploaded documents

Receipts and attachments you upload are checked before they are stored: file types are verified by content (not just file name), size limits apply, and every upload is scanned for malware before it is accepted. Stored receipts are treated as audit evidence and kept unaltered for the statutory retention period.

Your data lifecycle, built in

• Download your data — a complete export of an organisation's (or your whole account's) records, including archived PDFs and receipts, any time.
• Erase personal data — self-service for your own details; per-record for customer and supplier contacts.
• Close or delete — account closure and organisation deletion with a 30-day change-of-mind window, after which personal data is anonymised.
• Statutory retention, then removal — financial records are kept 6 years as UK tax law requires, then permanently removed by a scheduled process. Sent-email content is removed after 24 months; export downloads expire after 7 days.

Read the full retention policy →

Backup and recovery In development

Automated, encrypted off-site backups with tested restore procedures are in development and will be in place before commercial launch. We say this plainly rather than claim it early: this page only describes controls that exist. In the meantime you can take a complete copy of your own data at any time with the built-in export.

Privacy and UK GDPR

Sales Scribe is designed around UK GDPR principles: data minimisation, purpose limitation, the right of access (the export), the right to erasure (built-in anonymisation), and storage limitation (enforced retention clocks). Exports deliberately exclude internal identifiers so that erasure cannot be undone by old files.

This page is a plain-language summary, not legal advice or a contract.

• Privacy Policy
• Terms & Conditions
• Your data and privacy (help centre)

External services we use

We keep the list of third parties that touch your data deliberately short. Platform emails (invoices you send, notifications) are delivered through our own mail infrastructure; if you connect your own email provider instead, that relationship is directly between you and your provider.

This list is maintained as part of this page and updated when providers change.