You are being asked to put your company’s money into software you have not used before. Here is exactly what happens to it.
Every financial row belongs to a corporate account, and the boundary is enforced in the query layer rather than in each screen. It fails CLOSED: with no organisation to scope to, a query matches nothing instead of everything. There is no superadmin exception in it — whoever administers the installation manages accounts and exchange rates and never sees a figure inside your books.
Access is granted per module and per verb — browse, create, read, update, delete — with separate switches for the financially consequential acts: confirming a parsed statement, paying an instalment, collecting a debt, exporting the ledger. A missing row is no permission. On top of that, somebody can be restricted to particular accounts, so a bookkeeper reconciles the company accounts and never opens the director’s wallet.
Uploads are stored outside the web root and streamed through a controller that checks your rights first. There is no public URL to guess, and no directory to enumerate.
A colleague is invited by address and sets their own password through a single-use link, which also confirms their e-mail. The link is an opaque random token stored only as a SHA-256 hash; re-inviting invalidates the previous one, and an unknown, spent or expired link answers 404 rather than explaining itself.
Every transaction carries the exchange rate captured when it was written, in its own row, and nothing later rewrites it. That is what makes last quarter’s report say the same thing next year: it does not consult a rate table again. Rates themselves are refreshed from several independent providers, so the figure frozen onto the row was a real one.
CSV export covers the ledger, the reports and the customer records, and it keeps working on the free tier. Stopping payment does not lock anything: a plan whose term runs out drops to the free tier rather than freezing, so you go on reading AND writing your books within the free limits. Nothing is deleted.