Tenancy with row-level security.
Every firm is its own tenant, enforced in the database with Postgres row-level security. A query from your firm cannot return another firm's rows, even by mistake.
Security & trust
Your clients' books. Your firm's controls.
Built for firms that answer to clients, auditors, and regulators. This page says exactly what happens to what you upload.
How it is built
Eight facts, no adjectives.
Approvals on every write that matters.
Finalizing a month, posting a journal entry, sending an email, changing a client's setup: each waits for a person to approve. Penny proposes; your team decides.
A full audit log per month.
Every change inside a month is recorded with who, what, when, and why, Penny's included. Reopen a month and the trail stays.
Statements kept only while a month is open.
Uploaded statement PDFs exist to be read, not kept. Once a month is finalized, they are removed from the platform's working storage and the ledger is what remains; any archived copy is encrypted and not reachable from the app.
Encrypted in transit and at rest.
All traffic runs over TLS, and stored data is encrypted at rest. Integration tokens for Google, Plaid, and Stripe are stored encrypted as well.
Encrypted off-site backups with restore tests.
Backups are encrypted and kept off-site, separate from production. We restore from them to prove they work rather than hope they do.
SSO and authentication.
Sign-in runs through WorkOS, with SSO for firms that need it. Roles control which clients and which actions each seat can reach.
SOC 2 in progress.
We are on the SOC 2 track: controls are being documented and audited now. We will say in progress until the report is in hand, and never certified before then.
Approvals
How approval works.
Nothing Penny does becomes final on its own. The step that matters is yours, and it is recorded.
The December card for Harbor & Pine, as Penny presents it.
- 01
Penny proposes.
She closes the month, runs the review pass, and presents what will happen if you approve: counts, totals, and any journal entry.
- 02
You approve.
A person reads the card and decides. Send it back and she keeps working; approve and the month locks.
- 03
It's final and logged.
The month is finalized, the audit log records who approved what and when, and the trail stays even if the month is reopened.
Your data
Your data stays yours.
SOC 2: in progress.
Controls are being documented and audited now; we will update this line when the report is in hand.
No training on your data.
Your books, documents, and conversations are never used to train models. Penny is built on frontier models under terms that keep it that way.
Export anytime.
Every report, ledger, and list exports to Excel, PDF, or Word whenever you ask. No request to support, no notice period.
Disconnect anytime.
Bank feeds, Google, and Stripe connections can be removed by you in a click, and their tokens are deleted when you do.
Security review
Have a questionnaire? Send it.
Join the list and mention your security review. We answer it before you sign anything.