Simplebks logo
Log in Start Free

Home / Company / Security and Data Protection

Security and Data Protection

Security and Data Protection

Your books hold your customers, your prices and your money. Simplebks protects them with controls you can see and use: who can do what, who approved what, and a record of what happened.

This page describes what Simplebks does today.

Start your 14-day trial

You decide who can do what

  • More than 240 permissions. Give each team member only the actions their job needs: ring up sales but not edit prices, or raise purchase orders but not approve them.
  • Ready-made roles and your own. Start from built-in roles such as Sales Teller, Business manager, Inventory manager, Accountant, Finance/Reports, Expense manager, Production manager and POS Supervisor, or build a custom role.
  • Limits on branches. Restrict a person to the branches they work in.
  • Time-limited access. Give a teammate access for a set number of days. It ends on its own.
  • No one can grant more than they hold. A team member who can invite others cannot give them permissions they do not have themselves.
  • Removal signs people out. When you remove a member, or a password is reset, their active web sessions end.

Approvals for actions that move money

  • Supervisor approval at the till. When a cashier's role does not allow a sensitive action, such as editing a price, deleting an item, a refund, an exchange, a discount, a credit sale or closing a register with a variance, a supervisor approves it with a personal PIN at the till or from a remote request. Repeated wrong PINs lock the prompt for a while. The till is on the Professional and Enterprise plans.
  • Purchase order approval. On Professional and Enterprise, only people with approval rights can approve a purchase order.
  • Approval to void or delete. Switch on approval for invoice voids and transaction deletes.
  • Approval for large stock write-offs. On Professional and Enterprise, set a value above which a second person must review a stock count before it posts.
  • Requests and advances (Enterprise). Staff request spending or an advance, and someone else decides.

A record of what happened

  • An Activity log shows who did what and when across sales, approvals, stock counts and adjustments, accounting, settings, team changes and document downloads. The business owner sees it and can grant the right to others. Recent activity stays in the log for 90 days.
  • Books are corrected, not erased. On Professional and Enterprise, where manual journals are available, a journal entry is voided with a reversing entry or corrected. There is no delete for journal entries.
  • Lock a period. On Professional and Enterprise, lock your books through a date and nothing can be posted with a date on or before it. Only people with the business settings permission can move the lock date. Year-end close, with a preview and a confirmation, is on the same plans.
  • Simplebks staff actions are logged. Requests made by Simplebks administrators are recorded in an audit log.

Sign-in and sessions

  • Passwords are stored as salted one-way hashes (PBKDF2 with SHA-512). Simplebks cannot read your password.
  • Email verification confirms a new account with a one-time code.
  • Google sign-in is checked with Google on our servers.
  • Sign-in attempts are rate limited. Sign-in, sign-up, password reset and one-time-code requests are limited to slow down guessing.
  • Protected web sessions. Web session cookies cannot be read by page scripts and are sent only over HTTPS in production. The app sends an HSTS header so browsers keep using HTTPS.
  • Exporting business data asks you to sign in again. It needs a sign-in from the last 15 minutes.

Encryption

  • Credentials for your integrations are encrypted before they are stored. Your Paystack secret key, webhook signing secrets, WooCommerce keys, bank-feed account link and email-sync tokens are sealed with AES-256-GCM. Screens show only a masked tail of a key.
  • Session tokens are stored as one-way hashes. The mobile app's refresh tokens are kept as SHA-256 digests, not as the tokens themselves.
  • Data exports are encrypted. Each export, a zip of Excel and CSV files, is encrypted with its own key (AES-256-GCM) and expires after 7 days.

Payments

Card payments for your Simplebks subscription are handled by Paystack, and Simplebks does not store card numbers.

Paystack payment notifications are checked by signature before Simplebks acts on them, as are WhatsApp and WooCommerce notifications.

Your data stays separate

Each business's data is scoped to that business. Which businesses you can open is worked out on our servers from your account and role, not from anything your browser sends.

Private uploaded files are served only to a signed-in member of the business that owns them.

Accountants and consultants

  • Accountants join only when you accept their invitation. You choose their access rights from a checklist, can change them later, and can revoke access at any time. Exporting your data is a right you grant separately. See For Accountants.
  • Consultants connect only when you accept. Access is view-only, limited to a fixed set of sections, with sensitive fields left out. You can end the connection at any time. See Become a Consultant.

Your data is yours

  • Export your records. Owners and admins can export a zip of Excel and CSV files as a protected download, up to 2 exports a day. An accountant can export only if you have granted that right.
  • Close your account. Only the owner can close the account, and it asks for the owner's password.
  • Marketing emails are your choice. Each user can switch marketing emails off.
  • Privacy questions. Write to [email protected] to ask about your personal data. Read the full Privacy Policy.

FAQ

Can I control what each team member can see and do?

Yes. Each person gets the permissions their job needs, from built-in roles or a custom role, and you can limit them to certain branches or a set number of days.

Can I see who changed something?

Yes. The Activity log shows who did what and when. The owner sees it and can grant the right to others. Recent activity stays in the log for 90 days.

Can someone delete a journal entry?

No. A manual journal entry is voided with a reversing entry or corrected. On Professional and Enterprise, locking your books through a date also blocks postings dated on or before it.

How are passwords stored?

As salted one-way hashes using PBKDF2 with SHA-512. Simplebks cannot read your password.

Does Simplebks store my card details?

No. Subscription card payments are handled by Paystack, and Simplebks does not store card numbers.

Are my integration keys encrypted?

Yes. Your Paystack secret key, webhook signing secrets, WooCommerce keys, bank-feed account link and email-sync tokens are encrypted with AES-256-GCM before they are stored.

Can I give my accountant access, and take it back?

Yes. The accountant joins when you accept their invitation. You choose the access rights, can change them later and can revoke access at any time.

Can I export my data?

Yes. Owners and admins can export a zip of Excel and CSV files as an encrypted download that expires after 7 days, up to 2 exports a day. It needs a recent sign-in.

Can a supervisor approve discounts and refunds at the till?

Yes. When a cashier's role does not allow a discount, refund or credit sale, a supervisor can approve it with a personal PIN. The till is on Professional and Enterprise.

Related pages

Contact

Email, Help Center and setup calls.

Start free and set up roles and approvals for your team.

Start Free See pricing
Roles, approvals and an activity log for your books.
Start Free