StowbillConfidential client work deserves real controls
Deal documents, financial statements and board papers are among the most sensitive files a firm holds. Stowbill enforces the controls in the system, not in a policy document.
Who can get in
Two-step login
Every user can sign in with an authenticator-app code, and administrators can require it for the whole firm. Ten one-time recovery codes cover a lost phone.
Account lockout
Five wrong passwords or codes lock the account for 15 minutes, and the owner is emailed. Sign-in, sign-up and reset forms are rate-limited.
Sessions
Passwords are hashed with scrypt and a unique salt. Sessions use HTTP-only cookies, end after 30 minutes of inactivity, and are signed out everywhere when a password changes.
What each person can see
Firm isolation
Every query is limited to your firm. No other firm's users can see or reach your data.
Need-to-know access
Staff see only the engagements they lead or work on. Partners see the whole firm. Administration alone does not open confidential engagements.
Private client links
Each client upload link is a random 192-bit token for one engagement. It expires, you can replace it at any time, and clients can only upload, never browse your work.
How work is controlled
Separation of duties
Preparers cannot review their own work. Only partners can waive checklist items, approve stage moves or create other partners.
Version-tied sign-off
A sign-off applies to the version that was reviewed. A new review note clears the reviewer's sign-off until it is resolved.
Locked when finished
Archived and locked engagements are read-only for everyone, including administrators.
How data is kept
Encrypted file storage
Uploaded files are stored privately with encryption at rest and are only ever downloaded through a permission check.
Append-only trail
Every significant action is logged with who and when. Database triggers reject any attempt to edit or delete the trail.
Secrets kept secret
Two-step login secrets are encrypted with AES-256-GCM. One-time codes and links are hidden from the firm's own email log.
Hosting and data location
Your database and files are hosted on Amazon Web Services in Sydney, Australia (the database through Supabase), encrypted at rest and in transit, with a separate copy of the database taken every day and kept for 30 days. The application runs on Vercel in the same region. Files sit in a private bucket and are only served after a permission check; old versions are kept for 30 days.
If your clients or regulators set rules on where data is kept, talk to us about a different region. We can share our security review on request.