Security and privacy
Your books, your keys, your customers' details.
GoSmoko holds the commercially sensitive middle of your business: what you charge, who you charge, and the keys to your accounting and payment providers. Here is exactly how each of those is protected.
Credentials encrypted at rest
Every API key and OAuth token is encrypted with AES-256-GCM before it is written to the database. The encryption key lives in the environment, not the database, so a database copy on its own is useless.
One business, one boundary
Every record carries the business it belongs to, and every query is scoped to the signed-in user's business. There is no shared table you can read across by guessing an ID.
Keys are write-only
Once saved, an API key is never shown again — not to you, not to support. The interface shows a masked hint so you can tell which key is in place without exposing it.
Customer links, not customer accounts
Quotes and invoices are shared through an unguessable random token. A customer can view, accept, decline, or pay without an account, and the link exposes that one document and nothing else.
Webhooks are verified, not trusted
Stripe payment notifications are checked against your own signing secret with a timing-safe comparison and a timestamp window, so a forged or replayed call cannot mark an invoice paid.
Integration safety
Least access, always revocable
We ask providers for the narrowest permission that makes the feature work, and we make it easy to take it back.
- Xero and MYOB are connected through their own sign-in screens — we never see or store your password.
- OAuth state is signed and single-use, so a connection request cannot be forged or replayed.
- Access tokens are refreshed automatically and re-encrypted each time; an expired connection surfaces as 'Reconnect' rather than failing silently.
- Stripe keys are validated the moment you paste them, so a wrong or revoked key is caught before an invoice depends on it.
- Every sync writes an activity entry, giving you an audit trail of what was pushed, pulled, and rejected.
Questions
Security FAQ
Where is my data stored?
In a managed Postgres database with encryption at rest and automated backups. Your business data is never shared with other customers and is never used to train models.
Can GoSmoko staff see my invoices?
Support can only see your data if you ask us to look at something and grant access. We cannot read your stored integration credentials at all — they are encrypted and never decrypted outside a live request from your account.
What happens when I disconnect an integration?
The stored credentials are deleted immediately, not flagged as inactive. Records already pushed to Xero, MYOB, or Stripe stay in those systems, because they are your records in your accounts.
Is the AI reading my customer data?
The smart inbox sends only the text you paste in to your configured AI provider to extract fields from it. It does not send your customer list, your invoices, or your pricing, and nothing is retained for training.
How do you handle GST and record-keeping obligations?
Invoices are issued with sequential numbering generated atomically, so numbers are never reused or skipped under load. That matters for IRD and ATO record-keeping, and it is why we do not renumber documents after the fact.
Do you support two-factor authentication?
Sign-in with Google is supported today, which lets you inherit whatever two-factor policy your Google Workspace enforces. Native TOTP for email and password accounts is on the roadmap.
Found something that looks wrong?
We would much rather hear about it than not. Email security@gosmoko.com with what you found and how to reproduce it. We will confirm receipt within two business days and keep you updated until it is closed.
Sensible defaults, out of the box.
You should not have to configure security. Start the trial and it is already set up this way.