Security

Hosting and encryption

• Blink runs on Microsoft Azure in the Canada Central region.
• All traffic is TLS-encrypted. All data is encrypted at rest.
• The database is not reachable from the public internet; it sits inside a private network and is reachable only by the application.
• Secrets and connection strings live in Azure Key Vault, not in configuration files or source control.

Accounts and access

• Sign-in is by Microsoft single sign-on or an email and password. Sessions expire after 30 minutes of inactivity and can be revoked centrally.
• Each tenant’s data is isolated at the database level, not only in application code.
• Credentials for your accounting system are stored as encrypted OAuth tokens. We never store your Xero or QuickBooks Online password.

Controls built into the product

• Separation of duties. The approver of a journal entry cannot be its preparer. The application enforces this; it is not a policy you have to remember.
• Append-only audit trail. Every calculation, change, approval and posting is recorded. Entries are cryptographically hashed so tampering is detectable.
• Nothing posts without approval. Only an approved journal can reach the general ledger.
• Sign-off certificates. A signed-off document produces a verifiable certificate, and going stale re-opens it rather than silently passing.

Theta Advisory holds no SOC 2 or ISO 27001 certification, and no audit against either has been performed. The controls above were built with those frameworks' criteria in mind, which is not the same thing as being certified against them — if that changes, this page will say so plainly rather than implying it.

How we build

• Dependencies are scanned continuously, and vulnerable ones are patched on a schedule driven by severity.
• Static analysis and secret scanning run on every change before it can merge.
• Deployments are automated and reproducible; infrastructure is defined as code.
• Production access is limited to named individuals and is audited.