Security

A plain description of how Peris One protects your account and your business's data.

Passwords & Sign-In

• Passwords are never stored in plain text — they're hashed with bcrypt before being saved.
• Sign-in sessions use a signed, time-limited token in an HTTP-only cookie, so it can't be read by page scripts.
• New sign-ups verify their email address before getting full access to the app.
• Sign-in and sign-up attempts are rate-limited, and both are protected by a CAPTCHA check, to slow down automated attacks.

Your Data

• Every business's data is kept separate — a user can only see the businesses they've been given access to.
• Access within a business follows roles: Admin, Staff, or read-only (for outside accountants). Sensitive actions, such as changing settings, archiving records or voiding a posted document, are limited to Admins unless an Admin allows more.
• Every important action — creating, editing, voiding, or deleting a record — is written to an audit log that records who did it and when, and it can't be edited afterward.
• Financial entries are never deleted once posted; corrections are made with a new, linked reversing entry, so the history stays intact.

Infrastructure

• Data is stored in a managed PostgreSQL database, accessed only over an encrypted (TLS) connection.
• Database credentials and other secrets are kept in server-side configuration, never shipped to the browser.

Reporting a Concern

If you believe you've found a security issue, please contact hello@perisone.com rather than posting it publicly. We'll look into it as a priority.