Your business, kept where it belongs.

Every business in VaultYou has its own workspace, enforced in the database rather than in application code. Row-level security policies mean a query can only ever return rows belonging to a business the signed-in user is a member of — even if a bug existed higher up the stack.

Membership is granted through an explicit owner or admin action. Users cannot add themselves to a business they do not belong to.

All traffic between your browser and VaultYou is encrypted in transit using TLS (HTTPS), with HTTP requests redirected to HTTPS. Data at rest is encrypted by our hosting and database provider using industry-standard disk encryption.

You can sign in with email and password or with Google. Passwords are never stored in plain text — authentication is handled by our managed identity provider, and we never see your Google credentials.

Sessions are held in your browser and refreshed automatically, and signing out clears the session immediately. Password reset is self-service via a time-limited emailed link.

Business logos and expense receipts are stored in private buckets. Files are never publicly listable or guessable — each request is authorised against your business membership before the file is served.

Invoice numbering is allocated server-side and atomically, so two devices can never produce the same number. Totals are calculated in whole cents on the server rather than in the browser.

Once an invoice is sent it becomes immutable — corrections are made by voiding and reissuing, which preserves an auditable trail for you and your accountant.

AI requests are authenticated, validated and rate limited per account. Only the context needed to answer your question is sent to the model provider, and the AI can only ever see data from your own workspace.

The AI Coach has no authority to act. It cannot send, pay, lodge or commit anything — every action requires your explicit confirmation. See the AI Disclaimer.

If a data breach occurs that is likely to result in serious harm, we will assess it promptly and notify affected individuals and the Office of the Australian Information Commissioner in line with Australia's Notifiable Data Breaches scheme.

Security is a partnership. We handle the platform; a few things stay with you:

• Use a strong, unique password and keep your email account secure.
• Only invite people who genuinely need access to your business.
• Sign out on shared or public devices.
• Keep your own copies of records you're required to retain.