Security

Last updated: 4 June 2026

This page summarises how Bookfolio protects customer account, business, accounting, and uploaded document data.

Security questions and reports should be sent to hello@bookfolio.net.

1. UK hosting

Customer account, business, accounting, and uploaded document data is stored on UK servers. The current production infrastructure stores application database records and uploads in Google Cloud's London region, europe-west2.

The API runs on Google Kubernetes Engine Autopilot in europe-west2. PostgreSQL data is stored in Cloud SQL in europe-west2, and uploaded files are stored in a Google Cloud Storage bucket in EUROPE-WEST2.

Cloudflare serves and protects the public website and DNS for bookfolio.net, but it is not the system of record for customer content.

2. Encryption and transport

Bookfolio uses HTTPS/TLS for public web and API traffic. The public website is served through Cloudflare, and the API is served through a Google-managed certificate on the GKE ingress.

Strict Transport Security is configured for the Cloudflare-served public website. Google Cloud managed database and storage services provide encryption at rest for Cloud SQL, Google Cloud Storage, and Secret Manager data.

3. Authentication and sessions

Passwords are hashed with Argon2. Password reset tokens are single-use and time-limited.

Bookfolio sessions are backed by revocable server-side session records. API requests use authenticated session context, and business data APIs check that the signed-in user is a member of the relevant business.

Signup access requires the configured signup code until public self-serve signup is opened more broadly.

4. Roles and audit records

Bookfolio separates business access by role. Owner, admin, accountant, member, and viewer roles are enforced at product boundaries where those permissions apply.

Audit events record important activity such as authentication, settings, imports, posting, reports, VAT, and member changes.

5. Secrets and operational access

Runtime secrets are stored in Google Secret Manager and synced into the API runtime by External Secrets Operator. Deployment secrets live in GitHub Actions and are separate from runtime secrets.

Operational access is limited to what is needed to build, deploy, support, secure, and maintain Bookfolio. People with operational access must use that access only for legitimate business, support, security, legal, or compliance purposes.

6. Backups and recovery

Production Cloud SQL is configured with automated backups and point-in-time recovery. Uploaded-file storage uses bucket versioning.

Restore smoke tests are part of the production runbook. They check that a restored database can run migrations, start the API, respond to health checks, sign in, generate reports, and read audit events.

7. Vulnerability reports

If you believe you have found a security issue, contact hello@bookfolio.net.

Please include enough detail for us to reproduce and assess the issue. Do not exploit the issue, access customer data, disrupt the service, or publish details before we have had a reasonable opportunity to investigate and respond.

8. Limitations

No online service can guarantee perfect security. Bookfolio uses technical and organisational measures designed to protect the service and customer data, and we continue improving those controls as the product and infrastructure mature.