Security · Autessa Accounting
Security, permissions and audit for your books
Autessa Accounting protects financial data with a ledger that cannot be rewritten, a permanent activity log that includes automation, a Mercury token that never lands in a table, and roles that give each teammate only the screens their job needs.
Bank connection
How is the Mercury connection protected?
- The API token is written only into Accounting’s Mercury tools and used there to call Mercury.
- Accounting stores just the last four characters, who saved it and when. The token is never shown again, never logged and never kept in a table.
- The Mercury tools are shared only with teammates whose role can approve budgets or administer.
- Mercury refuses calls from anywhere but Autessa’s three outbound IP addresses on your token’s allowlist.
- You choose the token’s permissions in Mercury; Accounting shows which ones work.
- Replace the token if it leaks or someone leaves; Remove clears it from every tool and stops syncing.
- Agent card numbers are not shown or stored in Accounting; the card page links to Mercury.
Integrity
How does Accounting keep the books trustworthy?
Immutable ledger
Posted entries are never edited or deleted. Voids write reversing entries, and closed months are corrected only by reversal.
Nothing posts unapproved
Every synced or uploaded transaction waits for a person. AI only suggests a category.
Statements proven first
Running-balance or totals checks before import; continuing past a failed check records a reason forever.
No silent deletions
Duplicate detection counts identical rows and never drops a real charge.
Exact money
Amounts are integer cents end to end, and exchange rates are stored as exact integers.
Close checks itself
A month cannot close while anything is waiting, unmatched or out of balance.
Permissions
Who can see and do what?
Roles add up, and gated screens and actions are hidden from people whose role does not include them. Roles keep each person’s work focused, and the activity log records what everyone did.
| Role | Can |
|---|---|
| Everyone | Home, the cards they hold, their own card requests, reports, the activity log and help. |
| Bookkeeper | Plus upload statements, transactions, the review inbox, receipts, categories and rules. |
| Accountant | Plus posting, the ledger, journal entries, reconciling, bills, invoices, products and projects. |
| Controller | Plus departments, budgets, guardrails, cards and card requests, and paying bills from Mercury. |
| Admin | Plus closing months, the Mercury connection and the team. |
Audit
What does the activity log record?
Everything that happened, newest first: who did it, what it was before, and why, including what Mercury sync and guardrails did on their own. Role changes and teammate deactivations are recorded too. The history cannot be edited or deleted. Supporting documents and notes on posted entries add context without changing the entry.
Trust Center
Autessa’s security and compliance documentation
Infrastructure, policies and compliance reports for the Autessa platform Accounting runs on are published in the Trust Center.
Visit trust.autessa.com →FAQ
Security questions
Where is my Mercury API token stored?
Only in Accounting’s Mercury tools, where it is used to call Mercury. Accounting keeps its last four characters, who saved it and when; the token is never shown again, never logged and never kept in a table.
Can someone change posted numbers?
No. A posted entry is never edited or deleted. Corrections are reversing entries, and both stay visible. Closed months can only be corrected that way.
Is there an audit trail?
Yes. The activity log records every change with who made it and what it was before, including what Mercury sync and budget guardrails did on their own. It is never edited or deleted.
Where can I find Autessa’s security and compliance documentation?
At the Autessa Trust Center, trust.autessa.com.
100% customizable, code and all
Make Autessa Accounting fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours