Security

Encryption

TLS in transit, version 1.2 minimum and 1.3 by default (Let's Encrypt certificates), and Fernet encryption for sensitive fields such as exchange API keys. Backups are encrypted before they leave the server, with a key only we hold, and are kept on a second server in Nuremberg rented by Coral Capital GmbH, a separate Swiss company that cannot read them.

Sign-in

Passwords hashed with Argon2id (OWASP parameters), two-factor authentication by app (TOTP, RFC 6238) or by a 6-digit email code, refresh tokens rotated on every use with reuse detection, progressive lockout after repeated failures.

Client separation

Every request is filtered by organisation in the application code, and your access is checked again on each request. PostgreSQL row-level security policies are already in place on the tables and will become a second barrier (see the roadmap below).

Audit log

Manual reclassifications, rules, clean-ups and fiscal-year locks go into an append-only log chained with SHA-256. The database refuses any edit or deletion of that log. Every exported FEC is archived with its SHA-256 fingerprint, checked again on each download.

Hosting in the European Union

netcup (Germany (Nuremberg, European Union)): website, application, database and files (receipts, FEC). Coral (Germany (Nuremberg, European Union)): hosting of encrypted backups it cannot read. Supabase (Ireland (European Union)): former copy of the database and files, deleted by 09/12/2026 at the latest. The third-party services (email delivery, block explorers, prices) and what they receive are listed in the privacy policy, in French.

Compliance

Under the GDPR, TLM Solutions is the controller for accounts, security and billing, and processes your accounting data on your behalf under the data processing agreement annexed to the terms of sale. A breach that puts data at risk is reported to the CNIL within 72 hours and to the organisations affected.

Report a vulnerability

Write to contact@trotme.fr and describe how to reproduce it.