Back to home

Security at Airbooks

Airbooks protects sensitive accounting and financial data with controls designed for a multi-tenant cloud service.

How we protect your data

  • Multi-tenant isolation is enforced in the database with row-level security.
  • All traffic is encrypted in transit using TLS 1.2 or later, and data is encrypted at rest using provider-managed encryption through Supabase and AWS infrastructure.
  • Access follows least-privilege principles. Role-based permissions control access within each organisation, and Airbooks staff access to customer data is restricted, justified, and logged.
  • Bank and integration tokens are stored server-side only and are never exposed to your browser.

Hosting and backups

Airbooks is hosted on Vercel, with application data stored in Supabase Postgres. We use automated daily backups and maintain encrypted offsite copies. Our restore procedures were tested in July 2026.

Bank feed security

Bank connections are made through Akahu's own secure authorisation flow. Airbooks never sees or stores your bank login credentials. Bank feeds are read-only: Airbooks cannot initiate payments or move money. You can disconnect a bank feed at any time from within Airbooks.

AI data use

Airbooks uses Anthropic for AI accountant chat, bank feed coding suggestions, and inbox document extraction. AI output is assistive: AI never changes your books without your confirmation, and feed coding or extracted document information requires human approval before posting. See our Privacy Policy for more detail about AI processing and the information involved.

Responsible disclosure

If you believe you have found a security vulnerability or incident affecting Airbooks, email security@airbooks.nz. We welcome good-faith security reports and aim to acknowledge them within five business days.

Please include enough detail to reproduce and assess the issue, avoid accessing or changing data that is not yours, and do not disrupt the service. Airbooks does not currently offer a bug bounty.

Security programme

Airbooks is not currently ISO 27001 certified, but our security programme is designed around ISO 27001-aligned controls.