Security and privacy.
Where the data lives, who processes it and how long it is kept.
Server and network
- Server
- In Germany, netcup.
- Network
- Traffic goes through Cloudflare.
- Encryption in transit
- TLS from browser and app to the server.
- Encryption at rest
- Only a hash of each password is stored. The mailbox password and the bank connection identifiers are stored encrypted (AES-256-GCM).
- Backups
- Daily.
Bank connection
- Service
- Enable Banking, a licensed account information service.
- Access
- Read-only. Caunto sees transactions and balances but cannot pay or move money.
Sign-in
- Methods
- Password, Google, Apple or a passkey.
- Account
- The same account works in the browser and in the iOS app.
Data processors
- netcup
- Server and storage.
- Cloudflare
- Network traffic.
- Enable Banking
- Fetching bank transactions.
- Receipt reading
- The receipt image or PDF is sent to Google’s Gemini service (Google Cloud EMEA Limited, paid tier) to read its details.
Retention and deletion
- Bookkeeping records
- The Finnish Accounting Act requires records to be kept for six years from the end of the year in which the financial period ended (KPL 2:10).
- Deleting your account
- Deletion cannot immediately destroy records the law says must be kept. The privacy notice explains what is deleted and when.
- Export
- You can export your bookkeeping data as CSV.
Responsibility
- Bookkeeping
- Caunto suggests, you approve. The entrepreneur stays responsible for correct bookkeeping.
- VAT return
- You file it yourself in OmaVero. Caunto does not send returns to the Tax Administration.
Found a vulnerability?
Tell us by email. Please do not test against other people’s accounts. info@caunto.fi