Security overview

Where your data lives

Rhea runs on Render, a hosting provider, in the United States: one web service, one database and one scheduled job for real customers, and a separate service with a separate database for the public demo, which holds sample data only. The database accepts no connection from the internet; only Rhea’s own services on the host’s private network reach it. Real customer data goes to the production service and nowhere else: the code refuses to load sample data there and refuses live vendor settings everywhere else, and nothing of a customer’s is ever copied to a laptop.

In transit and at rest

Every connection to the app uses HTTPS (TLS), with certificates the host manages. The database is encrypted at rest by the host. On top of that, Rhea itself encrypts the most sensitive things with AES-256-GCM under a key the service reads only when it starts: the access tokens and credentials for the services you connect (QuickBooks, Square, Shopify, 7shifts, a Toast export’s key), and every file you import. Each encrypted value records which key encrypted it, so the key can be rotated without downtime. A value that no longer decrypts is shown as “reconnect required”, never a crash and never written to a log.

Who can sign in, and how

Each person has their own account: an email address confirmed before the first sign-in, a password of at least 12 characters (hashed, never stored), and, on the hosted service, a second step at every sign-in of their own choosing: a passkey (recommended for owners), an authenticator app with backup codes, or a six-digit emailed code. Sessions end after a day without use; “Sign out everywhere” ends them all, and a password change or reset does too. Wrong passwords and codes are limited per browser and per address, and five wrong codes lock the second step for 15 minutes.

Inside an organization, roles decide what each seat may do (owner, bookkeeper, accountant, manager), and every page, action and download checks the signed-in person and their role on the server, not just in the browser. Seats are given by an owner, by an invitation link that works once for seven days, and taken back by the owner at any time.

One organization never sees another

Every record Rhea keeps for a customer is tagged with that organization, and every query filters on it. The organization a request acts for comes from the signed-in person’s membership, never from a form or a URL. Another organization’s identifier answers “not found”. A test suite builds two look-alike organizations and renders every page, export and action for each to check that nothing leaks; a new page can’t ship without its scenario.

Books that can’t be quietly changed

Every accounting entry must balance, and the database itself checks that at commit. A closed month’s entries, and entries already sent to QuickBooks, are never edited: a correction is a new reversing entry plus a new version, applied by a person. An add-only audit log, which the database refuses to change or delete, records every close, reopen and correction, every sign-in and failed sign-in, every change to a setting, every invitation and role change, and every look by Rhea’s own staff. Owners and their CPA can download it.

Less data in, less data out

Rhea doesn’t collect Social Security numbers, full bank account, routing or card numbers, customers’ details from your POS, or payroll below the summary level. Files that carry them are refused before anything is saved or sent anywhere; a Toast file’s guest columns are dropped the moment it is read; a bank statement’s account number is reduced to its last four digits and a one-way fingerprint. Payment cards and bank accounts for Rhea’s own billing, and vendors’ bank accounts for paying bills from Rhea, are entered on Stripe’s pages only, never on Rhea’s, so no card or account number ever reaches Rhea. Log lines carry counts, dates and identifiers, never file contents, file names, tokens, keys or full email addresses.

When Rhea uses a model provided by Anthropic to read a file it can’t read on its own, it sends only what that needs, only for a file a person dropped, with sensitive shapes masked and names blanked where it can, and never the ledger, account numbers, balances or other files. Anthropic may not train on it and deletes it within 30 days under its terms. The privacy notice has the full list of what is sent.

Rhea’s own access

Rhea’s staff can open a customer’s organization to support them, read-only, and must take an explicit “act as owner” step, good for at most 8 hours, to change anything. Every look and every such step is written to that organization’s audit log, and every record a staff member writes is marked as theirs. Rhea’s admin page shows counts and statuses across organizations, never ledger lines, amounts, employees, tokens or files.

Keeping the software sound

Every change to Rhea’s code is checked automatically before it ships: the type checker, the linter, the full test suite, a dependency audit that fails on a high-severity advisory, and a scan of the whole history for secrets. The tests use made-up data; no customer file is ever in the code repository. Secrets live only in the host’s dashboard, never in the code or on a laptop. Vendor credentials a customer creates for Rhea are saved only encrypted and organization-scoped, and their save, rotation and removal are audited.

Retention and deletion

Imported files are kept encrypted for 400 days after their import, then emptied by a daily job; a file checked but never imported is deleted within the hour. An owner asks for their organization’s data to be deleted on Setup → Your data; Rhea’s founder then runs a single command that pauses every feed, revokes Rhea’s access at each connected service it can, and removes every row of that organization in one transaction, leaving every other customer’s rows untouched. What remains is a record of the deletion (counts, and who asked) and the host’s backups until they age out.

When something goes wrong

Rhea keeps a written incident plan: cut the access in doubt (a seat, a connection, a key, a session secret), keep the logs and the audit log, find out what data and whose, and tell the customer plainly, within 72 hours of confirming a breach of security that affects their data, with what happened, what was involved, what Rhea did and what they should do. Every import attempt is recorded with its reason, a data health page shows each store’s last 14 days by source, and a daily job emails Rhea’s founder the same day a day is late or an import fails.

What this page doesn’t claim

Rhea does not hold a SOC 2 report or an ISO 27001 certificate, and doesn’t promise a particular uptime. It answers security questionnaires in its own words and will share its written information security program with a customer under a confidentiality agreement. Rhea is a young company with one engineer, and says so.

Reporting a security problem

Write to sales@rheafi.com. We answer within two business days, and we won’t take action against anyone who reports in good faith.