How your financial data is kept safe.

Each company's data is separate

Every table in the database has row-level security switched on. Each company's data is locked to the people allowed to see it, so one company cannot read another's. This is tested before each release.

For coaches and advisors, this means each client sees only their own company.

People see only what their role allows

Access is based on role. An advisor sees the client companies they manage. A client sees their own company and nothing else.

Two-step sign-in

Every account signs in with a password and a code from an authenticator app.

Encryption

• Xero and QuickBooks connection tokens are stored encrypted (AES-256-GCM).
• API keys are stored hashed.
• Connections to the app and its database are encrypted in transit. Older, weaker versions (TLS 1.0 and 1.1) are refused.

Reviewed against a published standard

The software is reviewed against OWASP ASVS Level 2, the industry standard for applications that hold sensitive data.

No usage tracking

Focus on Cash does not record which pages or features you use. Cloudflare counts visits to the website and sign-in page, without cookies.

Where your data lives

The database is hosted in Sydney.

Our suppliers

Supabase (database and logins), Cloudflare (hosting, the nightly encrypted backup and a locked copy of the security records), Xero and QuickBooks (data sources), Resend (email), Sentry (error reports) and GitHub (code). Each has SOC 2 or ISO 27001 security reports. Cloudmersive scans each uploaded logo for viruses, and says it keeps nothing after the scan.