00 / Security
Your Financial Data, Protected.
We handle sensitive financial information. We take that responsibility seriously. Here’s how we protect your data.
01 / Controls
SOC 2-Aligned Controls
We run internal controls reviews aligned with the SOC 2 Trust Services Criteria — covering security, availability, processing integrity, confidentiality, and privacy. We are not yet independently audited; a third-party SOC 2 examination is on our roadmap.
Encryption in Transit & at Rest
All data transmitted between your browser and our servers is encrypted in transit with TLS 1.2+. Data is encrypted at rest with AES-256 by our database and storage provider (Supabase on AWS). Your financial data is only accessible through authenticated sessions.
Multi-Factor Authentication
Access is role-based, and multi-factor authentication (MFA) using time-based one-time passwords (TOTP) is available for every James Analytics account. Backup codes are provided in case of device loss.
OAuth-Based Integrations
When you connect QuickBooks, Xero, or Puzzle.io, James uses OAuth 2.0 authentication. We never store your accounting platform login credentials. You authorize access through the provider's own secure flow, and you can revoke access at any time.
Session Security
Sessions are protected with JWT tokens and automatic 30-minute inactivity timeouts. If you walk away from your desk, your session locks automatically. Tokens are short-lived and cannot be reused after expiration.
Infrastructure Security
James Analytics is hosted on enterprise-grade cloud infrastructure with automated backups, monitoring, and incident response. Our database runs on Supabase (built on PostgreSQL) with row-level security policies enforcing data isolation between accounts.
02 / Commitments
Our Security Commitments
What we commit to every customer, every day.
- SOC 2-aligned internal controls reviews (not yet independently audited)
- No selling or sharing of customer financial data — ever
- Data deletion available on request with full account removal
- Minimal data collection — we only store what's needed to provide the service
- Regular dependency updates and security patching
- Incident response procedures with customer notification protocols
- Access controls with role-based permissions for team accounts
- Audit logging for sensitive operations and data access
03 / For government buyers
What we claim, and what we do not
Customer data for the James FP&A platform is stored in the United States: our database and storage provider is Supabase, hosted on AWS in the us-west-2 (Oregon) region. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256), access is role-based with TOTP multi-factor authentication available on every account, and sensitive operations are audit-logged.
We do not hold a FedRAMP authorization and do not claim one. We run SOC 2-aligned internal controls reviews and are not yet independently audited. For custom projects we can deploy into your own cloud account or on-premises environment so that data never leaves your boundary; ask us during scoping.
04 / AI & your data
How Ask James AI Uses Your Data
What happens when you ask a question
When you use Ask James AI, your question and relevant financial context are sent to Anthropic’s Claude API for processing. The AI analyzes your data to generate an answer, then the response is returned to you. Your financial data is used only to answer your specific question — it is not stored by the AI provider, used for model training, or accessible to other users.
What we don’t do
- We do not sell your data to third parties
- We do not use your financial data to train AI models
- We do not share your data with other customers
- We do not retain AI conversation data beyond your session
05 / Questions
Questions About Security?
We’re happy to discuss our security practices in detail. Reach out and we’ll connect you with our team.