Security

How we protect your books.

Cima Books was built for businesses that handle sensitive information, including healthcare practices. These are the guarantees the product is designed around.

AI sees financial figures only

The AI CFO is sent financial aggregates: accounts, amounts, vendors, categories and periods. Never protected health information, never patient or client names, never diagnoses, never bank credentials.
Requests are checked before they leave; anything that could carry PHI is blocked, not sent.
AI runs through Anthropic's commercial API, whose terms do not allow training on inputs.
Every feature has a non-AI fallback, and every AI answer cites the accounts and periods it used. Numbers come from posted entries, not from the model.

Your books are separate

Each organization has its own books file. A signed-in user can only reach their own organization's books.
Roles limit what each person can do: owners manage settings and people; a CPA gets view-and-export access.

Credentials and secrets

Passwords are hashed with scrypt and a per-password salt; they are never stored or logged in clear. Repeated wrong passwords lock the account for a while.
Bank connection credentials (SimpleFIN access URLs, Plaid access tokens) are sealed with AES-256-GCM outside the books file and are never logged or shown again.
Archived QuickBooks exports are stored encrypted, with every access logged.
Session cookies are HttpOnly and SameSite=Strict, and Secure when served over HTTPS. Writes must come from the app's own origin.

An audit trail you can trust

Every sign-in and every change to the books is recorded in a hash-chained audit log, so a removed or edited record shows up.
Entries are corrected by reversal, not by editing history. Closed periods are locked.

In the browser

A strict Content-Security-Policy: scripts, styles and images from our own origin only, and pages can't be framed by other sites.
The offline app shell never stores financial data or signed-in responses on the device.
No third-party trackers or analytics on the app or this site.

What's still in progress

We'll be straightforward about it: a SOC 2 report, a Business Associate Agreement for healthcare customers, and a public status page are on the roadmap, not done. Ask us before you put regulated data into Cima Books.