Your data kept safe, your account under lock and key
Your data is hosted in Canada, encrypted in transit and backed up every day. And you stay in charge of your account: a code at every sign-in, trusted devices you can revoke whenever you like, roles for your team, and an audit log that keeps track of the changes to your books.
Your data is hosted in Canada
Your data is hosted by OVH, on servers located in Canada. The team that builds InnoBooks and answers your questions is in Québec too.
A few outside services receive part of it, when you use the features that need them. The documents you have artificial intelligence read — receipts, invoices, labels, photos — are processed by AI services outside Canada. Card payments go through Stripe, and emails and text messages go out through outside delivery services.
Encrypted in transit, backed up every day
Everything that travels between your browser or our apps and our servers goes through an encrypted connection (TLS): that's the padlock in the address bar. An http address is redirected to the secure version, and your browser remembers to always use it.
Your data is backed up automatically every day. If something goes wrong, we can restore your information quickly.
Monitoring around the clock
Our infrastructure is monitored continuously, 24 hours a day, 7 days a week. Automatic alerts go off on suspicious activity or an attempt at unauthorized access, and our team steps in quickly to deal with the incident.
Repeated sign-in attempts are slowed down automatically, whether they come from the same address or target the same account.
A code at every sign-in
Every time you sign in with your password, InnoBooks also asks for a 6-digit code, sent by email and valid for 5 minutes. Someone who guessed your password still can't get in without it.
To stop depending on your inbox, switch to an authenticator app such as Google Authenticator or Authy: the code then comes from your phone. When you turn it on, you get eight recovery codes to copy or download. Each one works only once and gets you in if you lose your phone; you can generate new ones with your password.
Your password is never stored as is: InnoBooks keeps only a one-way hash of it. After ten wrong passwords, the account locks for 15 minutes. If you sign in with Google or Apple, the protection of your Google or Apple account applies.
- A 6-digit code by email, at every sign-in
- An authenticator app: Google Authenticator, Authy…
- Eight recovery codes, each single-use
- Account locked for 15 minutes after ten wrong passwords
Your devices and your sessions
On the computer you use every day, tick « Trust this device for 30 days » when you enter your code: for 30 days, that device will only ask for your password. The Security page of your profile lists your trusted devices, with their IP address and when they were last used. A shared computer, a phone you sold? Revoke it, or revoke them all at once: the code will be asked for again.
In the web app, a workstation left open signs itself out. The company's inactivity timeout goes from 5 minutes to 8 hours — 30 minutes by default — or can be turned off. Two minutes before you are signed out, a warning with a countdown lets you stay signed in or sign out.
- Trusted devices for 30 days
- Revoke one device, or all of them at once
- Sign-out after 5 minutes to 8 hours of inactivity
- A warning two minutes before
The security logs: who signed in, and from where
In the settings, the security logs show your company's sign-in activity: every sign-in, successful or failed, every verification code sent, accepted or rejected, every recovery code used, an authenticator app turned on or off, devices trusted and revoked, and sign-outs. Each event records the IP address and the browser used.
You filter by event type and by period. Failed sign-ins piling up, an address you don't recognise: you can see it.
- Successful and failed sign-ins
- Codes sent, accepted or rejected
- Devices trusted and revoked
- The IP address and browser of each event
To each their role, to each role its access
Five roles are ready to use: Admin, Manager, Employee, Contractor and Accountant. An employee tracks their own time and expenses, an accountant sees the reports and invoices, and only the Admin manages roles.
When none fits, the Admin builds their own from more than 180 permissions, each granted for oneself or for the whole company. A role can only receive permissions your plan includes. Creating a role and each role given to a member are written to the audit log.
- Admin, Manager, Employee, Contractor, Accountant
- Your own roles, permission by permission
- Each permission for oneself or for the whole company
The audit log: who changed what
The audit log keeps track of creations, changes and deletions in your books: receipts, payments, invoices and expenses with their lines and taxes, clients, suppliers, items and services, purchase orders, stock adjustments, recurring invoices and expenses, bank accounts and transactions, journal entries, month closings, projects, equipment and roles. Nothing to turn on: changes record themselves.
For each change, you see who made it, when, and, field by field, the old and the new value. On an invoice, the « Change history » button opens the history of that one document; an expense has the same link.
On the Transactions page, each line of the log is tagged « SEV (Fiscal) » — receipts, payments, invoices and expenses — or « General ». You filter by source, document type and period, and the log exports to CSV and PDF. No one can edit it or delete a line from it. General activity stays in it for 12 months; fiscal activity is never deleted.
- Who, when, and what changed
- The old and the new value of every field
- Fiscal (SEV) activity kept apart from general activity
- Export to CSV and PDF
The till's SEV journal
With the MEV-WEB compliant till, a second log comes in: the SEV journal, which records the compliance events of your sales. Successful or failed transmissions, cancellations, refunds, corrected receipts, going offline and back online, items removed, prices changed: each event is dated, and the journal exports to CSV and PDF.
Together with the audit log, which keeps the history of your receipts, payments, invoices and expenses with no time limit, you know what happened, sale by sale, and who did it.
PIPEDA and Québec's Law 25
InnoBooks complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal law that governs how businesses collect, use and disclose personal information, and with Québec's Law 25.
In practice, you can export your personal information and the books of the companies where you are the only administrator, and request the deletion of your account yourself, from your profile. Our privacy policy says what data we collect, why, and who we entrust it to.
Who can see your data?
You, and the team members you invite, each according to their role. The InnoBooks team only accesses your data to answer a support request, with your consent.
We never sell your data, and it is never shared for commercial or advertising purposes. It belongs to you.
If you close your account
You request the deletion of your account from your profile. For 30 days, you can change your mind by signing back in, and export your data. After that, your personal information — name, email, sign-in credentials, registered devices — is anonymised for good.
A company's books — invoices, receipts, MEV transactions — belong to the company: they don't disappear with one person's account. Anonymised accounting data is kept for seven years, as tax laws require, then deleted.
If an incident happens
If a security incident affects your data, we notify you without delay, as PIPEDA requires, take immediate steps to fix it, and report back to you.
A concern, a vulnerability to report? Write to us at [email protected]. We answer every security question within 24 business hours.
Depending on your plan
Security is not a paid extra. Two-factor authentication, trusted devices, the inactivity timeout, the security logs and the audit log come with every plan, from the Departure Package up; both logs are for the Admin and Manager roles.
Team members, and so their roles, start with Professional Access; only the Admin creates and edits roles. The SEV journal comes with the Point of sale add-on, available with Professional Access and the Elite Plan, and included in the Restaurant Package; it is for the Admin only.
- Every plan: two-factor authentication, trusted devices, inactivity timeout
- Every plan: security logs and audit log (Admin and Manager)
- Professional Access and up: team members and their roles
- Point of sale add-on or Restaurant Package: the SEV journal
See also
- Web application — All of InnoBooks in your browser, nothing to install.
- Additional modules — Point of Sale, QuickBooks and Sage export, and more.
📱 Our apps
The same data on the tablet, the phone and the web
One click away from getting started
Everything in one financial tool, designed in Québec for small businesses, freelancers and teams.
Create my free accountFree forever. No credit card required.