Founding-firm program open. Five clients, first month free. See details
Bursar.
Sign inRequest a demo
Sign inRequest a demo
Security · Data handling

What we hold, and what we do with it.

Bursar reads a client’s ledger, bank and card feeds, point-of-sale and delivery data, and the documents your clients send. Here is exactly what happens to each of those.

Encryption
AES-256 at rest and in transit.
Training
Never. Client financials are processed to produce your close and are not used as training data. This is stated absolutely because it is meant absolutely.
Access scope
Per firm, per client and per reviewer. A user’s firm is read from their verified sign-in token, never from the address they requested - so there is no URL that grants access to another firm’s data.
Audit trail
Every action on a close writes an immutable record: the close, the actor, the action and the time. Directory changes are recorded too, because who your firm chased is itself evidence.
Retention
Your data is deleted within 30 days of offboarding, and is yours to export before then.
Write-back
Exactly one connected source is ever written to - the client’s accounting file. Feeds, point-of-sale and delivery connections are read-only by design, and the product refuses to register them in the role that would allow a write.
Access

Tenancy is enforced in the code, not in the URL.

The most common way a multi-tenant product leaks is a route that takes a firm identifier as a parameter and trusts it. Bursar does not.

  • Every route is denied by default; access is granted, never assumed
  • The firm a request may touch comes from the verified sign-in token, never from the path
  • Sign-in is single sign-on through Google or Microsoft - Bursar stores no passwords
  • Sessions are short-lived and refreshable, and a replayed refresh token revokes the whole family rather than being honoured
  • Granting someone the credential that lets them sign off a close is restricted to firm administrators and partners - it is not self-service

How a request is authorized

DefaultDenied
FirmFrom the verified token
NeverFrom the URL
Sign-off rightsGranted by an admin or partner

Your client never learns Bursar exists.

Document requests and reminders go out under your firm’s name, from your firm’s reply address. Reports carry your letterhead. Bursar is not named to the client - and the professional obligation to tell your client that your firm may use a service provider is your firm’s to discharge, which is why the product models it rather than assuming it away.

Security review

Ask for what your review actually needs.

A questionnaire, a client’s diligence request, a partner’s sign-off - send it and it gets answered.

Get in touchSOC 2 status