Skip to content
Cash Flow Inventory / Docs
Platform

Security & Data Protection

This is the security foundation running underneath everything you do in Cash Flow Inventory: how your password is stored, an optional second factor on top of it, how your session is protected, how the app defends against common web attacks, and how the most sensitive settings actions are locked down to the actual business owner, no exceptions. Nearly all of it requires no setup from you — it's active by default for every account.

Who this is for

  • Every user, automatically — this isn't an opt-in feature.
  • IT and security teams evaluating the platform before rolling it out to a whole organization.
  • Business owners who want confidence that staff accounts can't quietly gain more access than they're supposed to have.

Security & Data Protection — the main screen

drop a screenshot at assets/screenshots/guides/security-data-protection.png to replace this

Password Hashing Two-Factor Authentication Session Security CSRF Protection Owner-Only Gate

1. PASSWORD SECURITY — MODERN HASHING, UPGRADED AUTOMATICALLY

Passwords are never stored in plain text. They're checked and stored using Argon2id, a modern, industry-recommended password hashing algorithm built specifically to resist brute-force cracking, even if a database were ever exposed. Older accounts get upgraded to this standard automatically and transparently the next time their owner logs in — no forced password reset, no separate migration project, no action required from you at all.

2. TWO-FACTOR AUTHENTICATION (2FA)

On top of your password, an account can turn on standard TOTP-based two-factor authentication — the same authenticator-app model (Google Authenticator, Authy, and equivalents) used across the industry, not a proprietary or SMS-only scheme. Once it's on, logging in also requires the current 30-second rotating code from your authenticator app, so a leaked or guessed password alone isn't enough to get in anymore. It's a real, working second factor checked at login time — not a settings toggle that only changes what the UI displays.

3. SESSION SECURITY

  • Your session cookie is locked down with secure transmission-only, JavaScript-inaccessible, and strict same-site settings — the standard hardening configuration that protects against cookie theft and cross-site attacks.
  • Your session ID rotates automatically at intervals during active use, shrinking the window in which a stolen session ID, if one were somehow captured, would still be useful to anyone.
  • Standard browser-level protections against clickjacking and content-type sniffing attacks apply to every page.

4. CSRF PROTECTION

Every request that changes data carries a unique, per-session security token, attached automatically behind the scenes to every action you take — you never see it and never think about it. If a request arrives without a valid matching token, the signature of a cross-site forgery attempt, it's blocked immediately and logged with the requester's information, rather than allowed to execute.

5. EVERY PAGE CHECKS YOU'RE ACTUALLY LOGGED IN

Every single protected page and backend action in the product verifies your active, valid session before doing anything at all. It's a consistent, repeated pattern applied uniformly across the entire application, rather than one central gate that a page reached a different way might slip past.

6. OWNER-ONLY ACTIONS — LOCKED, NOT JUST HIDDEN

Beyond the normal per-staff permission system (see the Settings & User Permissions guide), a small set of the most sensitive actions — changing core business information, locking an accounting period, resetting business data, and around 60 other settings-level actions — is restricted specifically to the actual business owner account, and only that account, regardless of what page permissions any staff member has been granted. Critically, this check happens twice: once to decide whether the button even appears on screen, and again, independently, inside the backend the button submits to — so even a technically sophisticated attempt to skip the page and hit the backend directly gets rejected the same way. Some of the most destructive actions, like Reset Data, add a further requirement: the owner has to type the exact business name to confirm before anything happens.

7. HOW IT CONNECTS TO THE REST OF THE SYSTEM

  • Settings & User Permissions — the staff permission system and this owner-only gate are two independent, complementary layers, not one system doing double duty.
  • Period Close & Lock, Reset Data — both lean on this same owner-only enforcement pattern as part of their own safety design.

8. WHY IT SCALES FROM SMB TO ENTERPRISE

01

Small business

Solid security is on by default here — nothing to configure, and so nothing to get wrong.

02

Growing business

As you add staff accounts, 2FA and the owner-only gate on sensitive actions mean a wider team never accidentally opens a path to the business's most consequential settings.

03

Enterprise

Modern password hashing with automatic migration, standard TOTP 2FA, layered CSRF/session protections, and a doubly-enforced (UI and backend) owner-only control on high-risk actions — these map directly onto what security teams actually check for during a vendor review.

Quick Reference

Quick reference — where things live 
  Most of these protections are active automatically — there's no setup
  screen to configure them.

  Turn on 2FA .............................. Your account/profile settings
  Related: Audit Trail visibility .......... Settings > Security & Access

See this running in your own account

Free to start, no credit card required — most businesses are set up and creating real records within minutes.

Create free account