Security Statement

1. Our approach

Cadence holds the financial records of the businesses that use it. This statement describes how CadenceFi Ltd protects that data and the service itself. Protection is built in at several layers, so that no single safeguard is relied on alone: the database, the application, the way people sign in, and the way we build and release changes.

We describe the kinds of measure we use, not their settings. Publishing the exact configuration of our defences would help an attacker more than it would help you. If your organisation needs more detail for a supplier review, see our security questions and answers or email support@cadencefi.co.uk.

2. Keeping each business separate

• Every business's data is separated from every other's. The database itself checks each request and returns only the data that belongs to the signed-in person's own company, so the separation does not depend on the application alone getting it right.
• Where our server code needs wider access to do its job, it takes the company from the verified sign-in, never from what a browser sends.
• The rules that separate companies are tested automatically before every release, including tests that try to read and change another company's data and must fail.

3. Where data is held

• Your account and company data are stored in the UK.
• Data travelling between your browser and Cadence is encrypted, and browsers are told to connect to Cadence only over an encrypted connection.
• Stored data is encrypted at rest.
• Passwords are never stored. Only a one-way hash is kept, which cannot be turned back into the password.
• The sign-in details for services you connect are kept encrypted and apart from the rest of your data.
• The database is backed up regularly, and an encrypted copy is kept away from the live service, so it can be recovered if something goes wrong. Only we hold the key to that copy.

4. Signing in

• Passwords must be long and varied. New passwords are checked against lists of passwords exposed in other companies' breaches. The check never sends your password anywhere.
• Anyone can turn on two-step sign-in with an authenticator app. Once it is on, the database refuses that person's data to any session that has not passed the second step.
• Repeated sign-in attempts are limited, and our sign-in, sign-up and password reset forms check that they are used by a person, not an automated script.
• Messages at sign-in and password reset never reveal whether an email address has an account.
• A link in an email signs you in only after you confirm the account it is for, so a link meant for someone else cannot switch you into their account.
• We email you when your password or email address is changed, so you know if it was not you.

5. Who can see your data

• People join your company only when one of your admins invites them. Invitations are tied to the invited email address, expire, and work once.
• Each person is either an admin, who can change data and settings, or view-only. An accountant you link gets read-only access, and you can hide sections of your data from them.
• When an admin removes someone, their access ends straight away.
• Our own internal tools show service-wide figures, such as usage and sign-ups. They are open only to named members of our team who have passed two-step sign-in. Access to the systems that run Cadence is limited to the people who operate the service.

6. Connected accounting and bank services

• Cadence only reads from the accounting software and banks you connect. It never creates, changes or deletes anything in them.
• You approve each connection on the provider's own page; your password for that service never passes through Cadence.
• The connection process is protected against requests forged by another website, and only returns to addresses we have fixed in advance.
• You can disconnect at any time from Settings, or revoke access from within the connected service. When you disconnect or delete your account, the stored connection details are deleted.

7. Payments

Card details are entered on our payment provider's own secure page. They never reach Cadence and we never store them. Messages from the payment provider are checked to prove they came from it before Cadence acts on them.

8. AI features

• AI answers use only your own company's data. They cannot draw on another customer's.
• Your data is not used to train AI models.
• AI output is shown as plain text and its links stay inside Cadence. It cannot run code in your browser or take actions on your account.
• Each company has a monthly AI allowance, which limits how much any one account can use.

9. Protecting the application

• Every page is sent with browser security settings that block content from unapproved sources, stop other sites framing Cadence, and turn off device features Cadence does not use, such as the camera and microphone.
• Information sent to Cadence is checked on our servers, and limits on its length and format are also enforced by the database.
• Uploads are limited in size, and images are checked for type from their content, not their name.
• Values placed in emails are made safe before sending, and spreadsheet exports are protected against formulas that could run when the file is opened.
• Limits on how often forms and features can be used protect the service from misuse.
• Error messages are general, so they do not reveal how the system works inside.

10. How we build and release changes

• Every change is tested automatically before it can go live, including tests of the server code that handles payments and data, browser tests of the website and the signed-in app, and tests of the database's access rules.
• A change reaches customers only after those checks pass. If they fail, the live service stays as it was.
• The software libraries we use are checked automatically for known security problems, and updates are reviewed and tested before they are applied.
• We keep a separate test environment, with its own database and test payments and no customer data. Database changes are applied there before they reach the live service.
• Secret keys are kept in the server environment only. They are never placed in the code or sent to your browser, and each environment has its own.

11. Monitoring and records

• Errors are reported to us automatically so we can act on them quickly. The reports are set up to leave out who you are, your IP address, what you type into forms, and names that appear in page addresses.
• Our logs are kept to what we need to diagnose problems, and are set up to leave out secrets such as access tokens.
• Edits, imports, syncs and settings changes in your company are recorded with who made them and when, and people in your company can review them.

12. Your data, your control

• You can export your data at any time. The export is either complete or it fails: it never gives you a partial file without telling you.
• When you delete your account, your company's data, files and connection details are deleted, and any subscription is cancelled first. Details are in our privacy policy and data processing terms.
• We do not sell your data.

13. If something goes wrong

If a security incident affects your data, we will tell you without undue delay, explain what happened and what we are doing about it, and give you the information you need to meet your own obligations. Where the law requires, we will also report it to the Information Commissioner's Office.

If you believe you have found a security weakness in Cadence, please email support@cadencefi.co.uk with "Security" in the subject line. We will look into every report. Please do not access other people's data or disrupt the service while testing.

14. Reviews and assurance

We review Cadence against recognised security standards, including the OWASP Top 10 and the OWASP Application Security Verification Standard, and check each finding in the code before it is fixed. We keep this under review as Cadence changes.

We do not yet hold an external certification such as Cyber Essentials or ISO 27001. Our security questions and answers show the current position.

15. Changes to this statement

We update this statement when our measures change. It describes our practice and is provided for information; our commitments to you are in our terms of service and data processing terms.