What we hold, who can see it, and how you check our work.
For finance teams and audit firms alike. Every line on this page is true today; anything we haven't done yet isn't here.
- Read-only connections
- Xero, QuickBooks Online, Bill.com and Ramp are connected read-only; no write access is asked for. Statements arrive by upload or forwarded email. Sitampu never posts, changes or deletes anything in your books, and never moves or holds money.
- What we hold
- Ledgers and statements as dated, fingerprinted snapshots. Evidence files, fingerprinted and stamped with who, when and where on arrival. Phone and account numbers, masked unless a person's role allows them.
- What we don't hold
- Your passwords for Xero, QuickBooks, Bill.com or Ramp: you sign in on their page. Card numbers: they go to our card processor.
- Where it's kept
- London, UK, on DigitalOcean. Encrypted in transit and at rest. Kept 7 years by default, then deleted, with a record that it was.
- Kept apart
- Each organisation's data is kept apart from every other's at the database level, not only in the app. Audit and Controls are walled off from each other too.
- Signing in
- Passkeys first, and two-step sign-in always on. Removing someone ends their sessions at once.
- Sealed and verifiable
- Workpapers, monthly reports and controls files are sealed with a fingerprint. Anyone can check a copy at the verify link. It shows who signed, when and the version, never amounts, payees or evidence.
- Who at Sitampu can see what
- Support can open an organisation read-only, with a reason, for at most 30 minutes, with personal data masked. Every look is logged. Staff never see which companies an audit firm audits.
- AI and your data
- A model reads scanned documents into fields such as date and amount. It never judges a payment or closes a case; people do. Your data isn't used to train models.
- Who we use
- Hosting: DigitalOcean. Card payments: Stripe. Email: Resend. Reading documents: Anthropic. SMS: Twilio.
Found a vulnerability?
Email hello@fidiba.com. We reply within 2 working days.
A question before you start?
Ask us anything about security or data.