Unfair CPA combines company-scoped access, explicit agent permissions and accounting constraints with evidence you can inspect. Security controls support your oversight; they do not remove the need to review outcomes and test recovery.
The invite-based request form lets you describe your workflow and security questions. It does not create an account.
Authority depends on the company, identity and operation. Connecting a tool is not permission to do everything.
Company membership and role checks bound ordinary access. Agents have a separate registration for each business. Selected-company runtimes keep each company’s identity and grants distinct.
Platform administration and service credentials are separate privileged capabilities that require their own operational controls.
Owners choose scopes, expiry and autonomy. Posting, approval, reversal and other sensitive actions require explicit grants. The server checks current authority when executing an operation.
Revocation blocks future request acceptance. Already accepted work may finish, so inspect its outcome. Client confirmation policies still apply.
Issuing selected-company agent runtimes and inspecting owner audit history require a current human owner with verified multi-factor authentication.
General MFA enrollment remains optional. These specific gates do not establish mandatory MFA for every user or every application and database path.
Database rules constrain accounting operations. Request history helps establish what was attempted and which changes were recorded.
The posting layer enforces double-entry balance. Posted journals are preserved and corrected with reversals; supported drafts have editing, deletion or voiding paths. Closed-period and permission rules still apply.
A balanced entry can still have the wrong classification or business meaning. Use the right correction workflow for linked invoices, bills and payments.
Supported API/MCP history includes actor, company, operation, timestamps, outcome and linked change events. Available execution-time snapshots retain the scopes, roles and autonomy recorded at the permission gate.
A passed gate does not prove success. Missing completion is unresolved and needs reconciliation; missing snapshots are not proof of no activity.
Compatible staged-transaction events expose selected redacted before/after values. Replays do not fabricate another record change. Current human owners with verified MFA inspect this evidence.
Other events may be metadata-only. This is not every-table coverage, complete browser/background capture or a record of external agent reasoning.
Explore the audit evidence and its limits, or follow the supported correction paths. Recorded history is not a cryptographic tamper-proof guarantee or an undo button.
Access restrictions, encryption and selective recording work together. Each has a defined scope.
Sensitive identifiers such as SSNs and EINs use field-level encryption. Company permissions and authorized reveal paths remain necessary; encryption does not replace access control.
Staged-transaction value snapshots exclude descriptions, counterparties, external import IDs and unlisted values. The visible evidence supports investigation without reconstructing the entire source document.
The application’s telemetry configuration disables automatic collection of sensitive categories such as cookies, request bodies, URL queries and AI content, and retains credential and URL scrubbing.
Custom logs and messages still need care. These controls are not proof that every manual value is sanitized or that a live alert reached an operator.
AI-assisted work may send selected content to configured model providers. Supplier terms and retention require separate verification; this page makes no blanket zero-retention or no-training promise. See the privacy notice and raise questions before sharing sensitive records.
The accounting application has separate checks for source security, reachable Git-history secrets, its complete dependency lockfile and production dependencies. These checks run on changes and a recurring schedule.
Implemented controls and a passing code check do not prove that every operational procedure has been exercised.
Use the request form to describe the workflow and security questions you want to discuss. Please leave credentials and financial documents out of the message.