Trust Center

1.Overview

Komod reads a customer's leases, invoices and bank activity and drafts the monthly close for a person to approve. The data it holds is the customer's financial record, so the platform is built around three rules: a person decides every posting, every record belongs to one organization and is never shown to another, and every act is written to an audit trail the platform only appends to.

This page states what the running platform does today. It is the same set of facts our Privacy Policy describes and our Data Processing Addendum binds us to, and it is updated when the platform changes.

2.Data protection

• In transit. Every connection is over HTTPS. The public edge terminates TLS and sends HTTP Strict Transport Security. Behind it the application, the database, the document store and the job queue listen on the loopback interface only and publish no public port.
• Connector secrets at rest. The credentials that link a customer's QuickBooks, mailbox and bank to Komod are stored under AES-256-GCM authenticated encryption — a fresh random nonce for every value, a key ring that supports rotation, and a re-encryption sweep that moves every stored secret to the current key without downtime. Every stored connector secret on the platform is under this cipher.
• Backups at rest. Backup sets are encrypted with a public-key tool when a recipient key is configured, and the private key is kept off the server.
• Documents as data. Document text goes to the model as data to read, never as instructions to follow.

3.Access control and roles

Access is by organization membership and role. The product has four roles, and each route on the platform is bound to the roles that may call it:

• Accountant — runs the close, talks to the assistant, decides the approvals put in front of them, administers the organization, and is the only role that can confirm an entry into the customer's books.
• Approver — decides the approvals put in front of them.
• Viewer — reads the owner portal for the whole organization and changes nothing.
• Owner (shown as Principal) — reads the owner portal for the buildings attached to it and changes nothing.

Sessions are signed tokens that expire after twelve hours; a password change signs every session out. Passwords are stored as bcrypt hashes, and a sign-in attempt costs the same time whether or not the address is known. An organization always keeps at least one Accountant. Browser pages carry a per-request Content Security Policy nonce, so an injected script does not run.

4.Tenancy isolation

Every record is scoped to the organization that owns it, and every read and write carries that scope. A record that belongs to another organization is answered as not found, never as forbidden, so nothing about it is disclosed.

Komod's own operator console creates organizations, invites the first accountant, grants credits and changes plans. It never reads a customer's documents, figures or conversations, has no way to sign in as a customer, and its every act is written to the customer's audit trail under Komod's name. The one view it has into a customer's use is the masked session replay described under Analytics, and each view is itself an audited act.

5.AI and the models we call

Every foundation model Komod may call is developed by a company headquartered in the United States or the European Union and is served from an enterprise cloud there. The rule is enforced in code, and no other model is used. The approved developers today:

• OpenAI — San Francisco, United States
• Anthropic — San Francisco, United States
• Google — Mountain View, United States
• Mistral AI — Paris, France (European Union)

Requests reach the developers through one model gateway — the first row of the sub-processor table below. Of the four, only the developers named in that table receive customer data today; a developer is added to the table, with notice, before it does. The model produces a proposal — an entry, a classification, a question, a draft — and a person approves it. Nothing reaches the customer's books without a click in the accountant role, and no report leaves the product except by a user's own act. Every figure in a report links to the transaction, lease clause, calculation or document it came from; a figure the platform cannot trace to its source is presented as a question, never a number.

AI use is metered against the customer's prepaid credits, one debit per conversational turn or document read, and each run records the model that served it.

6.What each connector reads

• Mailbox (Gmail, Microsoft 365 or IMAP) — the invoices and lease documents that arrive in the mailbox the customer connects, read when the close runs.
• Bank (through Plaid) — transactions and balances, read only; nothing is ever written to a bank.
• QuickBooks Online — the chart of accounts, vendors and journal entries; an entry is written only after a person approves it.
• Uploads — the leases, invoices, bank statements, check registers and spreadsheets the customer uploads by hand.

No connector is watched around the clock. A mailbox and a bank feed are read when the close runs or when a user asks; a mailbox can also be read on a schedule the operator turns on.

7.Sub-processors

The companies that process customer data on Komod's behalf. The same list is Annex III of the Data Processing Addendum; customers are given 30 days' notice before a new company handles their data.

The database, the document store and the job queue run inside Komod's own deployment and are components, not sub-processors. Transactional e-mail leaves through an e-mail relay Komod configures and carries the address, the link and the message, never a document. Payments are not live; a payment processor will be added here, with notice, before it receives any data.

8.Backups and continuity

A nightly job writes a complete set — the database and every stored document — with a manifest of checksums, and keeps seven daily, four weekly and three monthly sets. The set is encrypted before it leaves the server and copied off-site to the storage named in the sub-processor table, and the job records its last successful run. The scheduled host health check reads that record, fails its unit when the last success is more than 36 hours old, and notifies executive leadership the same way every other failed unit does. Every scheduled operations unit on the host carries an automated on-failure hook, and a failed run sends a notification to executive leadership. A restore drill restores a set from the server's local copy into a scratch database and a throwaway bucket and compares counts, so a restore is rehearsed rather than assumed. A readiness endpoint answers whether the database and the schema are healthy, and every response carries a request id.

9.Logging and audit

Every act on the books, every approval, every connection, every sign-in, every export and every operator act writes one row to an audit trail that the platform only appends to. Conversation transcripts are the controller's record and are kept whole; the platform never trims them. The customer can download its period's audit binder from the product. Application logs redact credentials and encrypted values; the public health endpoint says only whether the service is up.

10.Incident response

A scheduled health check on the host reads the service, the public edge, the containers, the disk, the scheduled units and the backup's last recorded success. A failed check sends the same notification to executive leadership that every other failed unit sends. When Komod confirms a breach affecting a customer's data it tells that customer within 72 hours, with what it knows, what it has done, and a point of contact, and supplements the notice as it learns more — as the Data Processing Addendum states.

11.Reporting a vulnerability

If you believe you have found a weakness in Komod, write to [email protected] with what you found and how to reproduce it. We read every report, confirm receipt, and tell you when it is fixed. Please do not access, change or keep another customer's data, and give us reasonable time to fix a weakness before you publish it. We will not take action against a researcher who follows these terms in good faith.

12.Analytics and privacy

Product analytics identify a user by an opaque id, the organization id and the role — never a name or an e-mail address — and carry no amount, no document and no typed value. Session replays are masked in the browser before they leave it: every text node, every input and every element attribute is replaced, so a replay shows layout, cursor and navigation and nothing legible. Analytics run only for signed-in users: the public pages set no analytics cookie and no advertising cookie.

13.Retention and deletion

Customer data is kept for the term of the agreement. When it ends the customer has 30 days to export its reports, documents and audit trail; then Komod deletes the live data. Backups expire on the normal rotation of seven daily, four weekly and three monthly sets. Komod keeps no separate archive of customer data.

14.Contact

Security questions and reports: [email protected]. Privacy questions: [email protected]. The legal documents are in the Legal Center.

A.The measures, as the DPA states them

Annex II of the Data Processing Addendum, word for word.