Security

Security & data protection

Last updated · 26 July 2026

Short version: your financial data is encrypted and access-controlled, kept in one region, and every record is append-only with its evidence attached. At Par prepares your books but never moves your money or files without your authorization — and a qualified accountant (ACCA) is accountable for the work.

How your data is protected

• Encrypted in transit and at rest. Your data travels over encrypted connections (TLS) and is stored encrypted on managed cloud infrastructure.
• Kept in one region. Your data is hosted on Supabase's managed cloud infrastructure in the Singapore region (ap-southeast-1) — not spread across locations.
• Least-privilege access. Access is role-based and limited to what a task needs; consequential actions require a second factor (step-up authentication).
• Separated per client. Row-level security isolates every client's data at the database level, so one workspace can never read another's.

What At Par will never do with your money

• It never moves your money. At Par prepares payments and filings; you authorize and execute them.
• It never submits filings on your behalf. At Par prepares them; you or your authorised tax agent submit through the official channel.
• It never edits history. Records are append-only — a correction is recorded alongside the original, never erased.
• It never records anything unchecked. Two independent checks must agree before a record is committed, and every figure carries its supporting evidence.

Certifications — where we honestly stand

We are not yet SOC 2 certified. A formal SOC 2 examination is on our roadmap. Until then, the controls described on this page are the ones in place today — we would rather tell you exactly where we stand than imply a certification we do not hold.

The providers we rely on

We keep our stack small and use a short list of established providers, each handling only what its job needs:

• Supabase — database and sign-in, hosted in Singapore.
• Vercel — serves the application.
• OpenAI — reads the documents you send so the desk can draft entries for review; it does not decide anything on its own.
• Resend — sends transactional email, like your confirmations.
• Cloudflare — protects our forms from automated abuse.

A person is accountable

At Par is not a black box. A qualified accountant (ACCA) is accountable for the patterns the desk runs on, and two independent checks stand behind every record. You authorize anything that moves money or files — the desk prepares, it does not decide for you.

Your data is yours

Your records stay yours — exportable in full, at any time. Corrections are recorded, never erased. Ask us any time to see, correct, or delete what you have shared and we will take care of it. How your business records and their evidence are handled once you become a client is set out in your engagement agreement and our Privacy policy.

Reach us

Security questions, or reporting a concern? Email hello@getpar.ai and it reaches a person.