Privacy & Security

shield_lockYour books are yours alone

Every company you create in JR Books is tied to your login. Each request to read or change a ledger, voucher, stock item or report is checked against the signed-in user before any data is returned. Another account cannot open, list or search your companies, even by guessing an ID.

We do not sell, rent or share your accounting data with anyone. We do not use it for advertising.

lockEncrypted on the way

All traffic between your browser and JR Books is encrypted with HTTPS (TLS). Plain HTTP requests are redirected to HTTPS, and browsers are told to use HTTPS only (HSTS). Figures, party details and passwords never travel in readable form.

keyPasswords

Your password is never stored. Only a one-way bcrypt hash is kept, which cannot be turned back into the password, not even by us.

Passwords must be at least 10 characters, and common passwords are refused. Repeated wrong attempts from one address or against one email are blocked for a while, which stops guessing attacks.

Changing your password signs out every other device that was using your account.

devicesSessions

After you sign in, your browser holds a session cookie that scripts cannot read (HttpOnly) and other websites cannot send (SameSite). A session ends after a period of inactivity, and it is bound to the browser that started it.

Every action that changes data carries a one-time security token, so another website cannot make changes in your books on your behalf.

databaseHow your data is stored

Data is kept in a dedicated database on a secured server. Every database query is parameterised, which is the standard protection against SQL injection. Configuration files, source code and database folders are blocked from direct access over the web.

Each change to vouchers and masters is written to an audit trail: who made it, when, and from which IP address. The trail can be exported from the app.

visibility_offWhat we collect

Only what is needed to run your account: your name, email address, optional phone number, and the accounting data you enter. We record the IP address and browser type of sign-ins and changes, for security and the audit trail.

JR Books does not load fonts, scripts or trackers from third-party services. No analytics or advertising cookies are used.

cloud_downloadYour control

You can export your ledgers, vouchers, registers, statements and GST returns to PDF, Excel or CSV at any time.

You can ask us to delete your account and all its companies. Once deleted, the data cannot be recovered.

reportIf something goes wrong

If we become aware of unauthorised access to your data, we will inform you without undue delay, with what we know and what we are doing about it.