Security overview

Effective August 28, 2026

GoDash handles financial data for the businesses that use it. This page summarizes how we protect it. It is written for the operators and advisors who decide whether to connect their books, and it is kept current as our practices change.

Hosting

The Service runs on DigitalOcean, LLC (data centers in the United States). Application servers, databases and backups live in DigitalOcean data centers that maintain SOC 2 and ISO 27001 attestations. Databases are managed services with automated daily backups, point-in-time recovery and network access restricted to our application hosts.

Encryption

• All traffic to and from the Service uses TLS 1.2 or later; HTTP is refused.
• Data at rest is encrypted by the hosting provider.
• Connected Service credentials (such as QuickBooks Online tokens) are additionally encrypted at the application layer with AES-256-GCM, using a key stored outside the database.
• Session tokens are stored only as one-way hashes.

Access control

• Sign-in goes through our central identity service with password plus time-based one-time codes. Invitation only — there is no open registration.
• Users see only the companies they have been granted. Each action that touches a connected company is recorded in an audit log naming the person who took it.
• Administrative access to production systems is limited to a small number of named engineers, uses SSH keys, and is logged.

Connected Services

• We request the minimum scope needed (for QuickBooks Online, the accounting scope only).
• Tokens are refreshed only when they expire and are never written to logs.
• Disconnecting — from GoDash or from the Connected Service — stops synchronization immediately and deletes stored tokens.
• Webhook deliveries are verified against the provider’s signature before they are accepted.

Operations

• Dependencies and base images are updated regularly; builds are reproducible and deployed through a reviewed pipeline.
• Systems are monitored for availability and errors. Security-relevant events are reviewed.
• We maintain an incident-response process. If an incident affects your data we will notify you without undue delay, with what we know, what we are doing and what you should do.

Reporting a vulnerability

If you believe you have found a security issue, email security@godash.pro. Please include enough detail to reproduce it. We will acknowledge your report, keep you informed and not pursue action against good-faith research that respects our users’ data and availability.