Security
Your business records deserve careful protection
Invoices, payments and customer details are some of the most sensitive information a business holds. This page explains, in plain language, the safeguards built into Gonexz Books.
Signing in
The first line of defence is making sure only the right people can sign in.
- Two-factor authentication
- Users can protect their account with an authenticator app. One-time codes can also be sent by email, and single-use recovery codes are available if a phone is lost.
- Trusted devices
- After a successful two-factor sign-in, a user can choose to trust a device and review or remove trusted devices at any time.
- Protected passwords
- Passwords are stored as one-way hashes, never in readable form. Password resets go through a time-limited emailed link.
- Sign-in throttling and lockout
- Repeated failed sign-in attempts are rate-limited, and an account is temporarily locked after several failures in a row.
- Automatic sign-out
- Sessions end after a period of inactivity, which limits the risk of a shared or unattended computer.
- Temporary passwords
- When an administrator creates an account, the new user must choose their own password the first time they sign in.
Access within your team
Not everyone in a business needs to see everything.
- Individual accounts
- Every team member signs in with their own account, so actions can be attributed to a person rather than a shared login.
- Role-based permissions
- Each user has a role — admin, accountant, sales person or viewer — and the application checks permissions on every request, not just by hiding buttons.
- Administrator control
- Organisation administrators decide who has access, can deactivate users, and manage security notification settings.
Separate workspaces
Gonexz Books is a multi-organisation service.
- Organisation-scoped records
- Each organisation's clients, documents and reports are scoped to that organisation and are not visible to users of any other organisation.
Alerts & audit trail
Knowing what happened is as important as preventing it.
- New sign-in alerts
- Users are emailed when their account is accessed from a browser or network location not seen before.
- Suspicious activity monitoring
- Sign-in activity is analysed for unusual patterns, such as repeated failures or unexpected locations, and organisations can adjust which alerts they receive.
- Audit log
- Important actions, such as sign-ins and changes to records and settings, are recorded with who made them and when, and administrators can review the log.
Data in transit & storage
Protecting information as it moves and where it is kept.
- HTTPS everywhere
- All connections to the application are served over HTTPS, so information is encrypted between your browser and our servers.
- Encrypted sensitive fields
- Particularly sensitive values, such as two-factor secrets and bank account numbers, are additionally encrypted in the database.
- Daily backups
- The database is backed up daily to separate cloud storage, with recent backups retained for recovery.
- Exports on your terms
- You can export lists and reports to CSV, Excel or PDF whenever you need a copy of your records.
Security is a shared responsibility
No online service can promise perfect security, and we don't. You can help keep your workspace safe by:
- Turning on two-factor authentication for every user, especially administrators
- Giving each person the lowest role that lets them do their job
- Removing access promptly when someone leaves the business
- Using a unique password that you don't reuse on other sites
- Reviewing new sign-in alerts and the audit log from time to time
Read our Privacy Policy and Terms & Conditions for how we handle your information.
Questions about security?
If you need more detail for your own review, or want to report a security concern, our team is happy to help.