The hosted connector protects connections, runs scheduled retention cleanup and records limited security events. This page explains those controls, the separately released desktop update and the limits that still apply. The Privacy Policy and Security Overview explain the processing boundaries.
Connection and credential protection
The hosted connector separately protects each connection's stored credentials, ends desktop access when a disconnect completes, and retires an earlier installation's access when the company reconnects. An unresolved operation can defer those changes.
Sovereign's service can still decrypt connection credentials to maintain the authorized connection. That boundary has not changed: your payroll records stay in the encrypted company file on your computer, and the connector processes readable accounting data for the requests you approve.
Retention and cleanup
The hosted connector runs cleanup on a schedule, including after a restart. It reduces finished operational records after the default 90-day period, or during disconnect cleanup, and deletes the resulting identity records 13 months after the operation. Those identity records retain a protected fingerprint of the accounting provider's company identifier rather than the readable identifier. An unresolved operation retains its full record until its outcome is settled.
Older records may remain until the retention process has handled them, including readable company identifiers retained without a previous time-based limit. A deletion confirmation reports what was actually removed.
Resolved account-setup plans are removed 30 days after they are resolved. An authorization session expires after 10 minutes. What the connector keeps stays linkable to your business and to a particular operation; we do not describe it as anonymous.
Disconnecting a connection
When you disconnect, the connector asks your accounting provider to revoke access, removes its copy of your credentials and ends desktop access in the same request. An unresolved operation can defer completion. Scheduled cleanup removes the remaining connection information afterward.
If the revocation does not succeed, the connector keeps retrying and still removes its own copy of your credentials; your accounting provider may continue to show the authorization until you remove it there. An outage delays this work until the connection catches up. Completed entries in your accounting system and your local files are unaffected.
Our planned policy to purge connection credentials and connection information within 24 hours of the effective paid-period end following cancellation, or an earlier manual desktop disconnect, is separate from this. That complete automated process is not fully deployed: there is no subscription-end deletion trigger, an offline disconnect takes effect only when it reaches the connector, offline requests are not currently queued for delivery, and unresolved operations and outages can delay cleanup. Nothing here is a 24-hour deletion guarantee.
Security records and misuse detection
The hosted connector records failed sign-in activity and limited security events, pauses repeated failed sign-ins and suspends unusual posting activity. Its alerts omit customer identifiers.
The event record covers connection setup, disconnection, posting attempts and access suspension, with the time and the connection involved. Failed sign-in records are kept for 30 days, posting events for 14 days and other events for 90 days. Failed sign-in records use protected address fingerprints to count repeated attempts; these records are not described as anonymous. The event log does not contain accounting data, request contents, your accounting provider's identifiers or network addresses.
Automated signals are not a claim of staffed monitoring. Our incident-response obligations under the applicable agreement are unchanged. Report concerns to security@ownmybooks.com. Railway separately keeps clear client IP addresses and browser details in its edge logs for about 30 days, and these changes do not affect Railway's logs.
Abuse limits
Abuse limits apply across the service's public routes, separately in its test and production environments.
Desktop company-file protection
The desktop update strengthens company-file protection and explains the consequences of choosing "Remember company". Company files and backups made before this protection change do not open in the updated version; it is not a backward-compatible update. Keep that in mind for older backups.
Payroll sandbox canary 0.1.9 includes stronger company-file protection and the Remember company warning. Availability on other release channels is separate. The hosted connector is updated separately from the desktop application.
Beside the "Remember company" choice and in Settings, the updated desktop app explains the consequence: if you choose to remember the company, its passphrase is saved on your computer and protected by your Windows sign-in. Anyone who can sign in to that Windows account, and any program running under it, can then open the company without the passphrase.
Other current boundaries
Some additional web-hardening measures commonly expected of a public site are not yet deployed. Administrative access is restricted, and further access-control improvements are planned and are not represented here as completed safeguards.
Automated agreement-acceptance recording is not yet enabled in the connector. Subscription billing is not yet integrated. Customer connections to live accounting data await accounting-provider approval. An earlier connector host is no longer in service, and erasure of the data it retained has not been confirmed.
Fixed retention periods are not yet established for every business record category outside the connector, including billing, support, form and marketing records.
For additional detail about a change or the information a service stores, contact privacy@ownmybooks.com.
Report a concern
Report vulnerabilities to security@ownmybooks.com. A fuller vulnerability-disclosure policy is planned; the reporting address is available now. Do not send passwords, tokens, tax IDs, bank details, employee records or full company files by ordinary email. Ask us to arrange an appropriate transfer method if sensitive information is needed.