Financial data demands real security — not a checkbox on a sales page. VibeCFO has been protecting accounting firm data since 2018. Below covers both our infrastructure security and how we handle AI specifically.
Our platform runs entirely on AWS Australia (Sydney), the same infrastructure trusted by the world's largest banks, government agencies, and financial institutions.
Every business that signs up to VibeCFO gets its own dedicated database. Your data is not pooled with other businesses.
Your data is physically separated from every other business
A vulnerability in one business's environment can never expose another's
Accounting firms managing multiple clients benefit from Row Level Security, ensuring each client organisation only sees their own data
When you leave, your data is entirely removed. No residual data.
This is the gold standard for financial data — and most platforms don't offer it because it costs more to operate.
Multiple layers of security to protect your data and access
All platform access requires MFA. No exceptions.
We know AI and financial data is a sensitive combination. Here's exactly how EVA handles your data, why you can't jailbreak her, and why hallucinations aren't a risk with our architecture.
EVA's core technology is text-to-SQL. Behind the scenes, we've invested significant time and resources mapping every integration's API schema — bundling, grouping, and merging tables and columns from API endpoints into clean, understandable data points. When you ask “total wages this month”, EVA translates that into a SQL query against your database. That's it. No generative guesswork.
Each integration has its own nuances — for example, “Sales this month” in Xero means Trading Income, which includes Account Type = Revenue and Sales. We map these nuances per integration so EVA understands your intent correctly.
When you check a visual and pin it to your dashboard, it becomes a stored SQL command querying your database. It is no longer processed by AI. If wages look incorrect or aren't updating, the issue is almost certainly in our ETL refreshing the data — not an AI hallucination. You can feel as confident in EVA's numbers as you do in a Power BI report or Excel formula.
The term “hallucination” refers to an AI generating plausible but incorrect information. This is a real concern when AI is asked to write essays, generate images, or answer open-ended questions. It is not a concern with EVA's architecture.
AI security is a moving target. Models change, new vulnerabilities emerge, and best practices evolve. We treat this as an ongoing discipline, not a one-time checkbox.
We maintain approved partner status with leading accounting and practice management platforms, passing their independent annual security assessments.
We also integrate with CIN7 and Shopify, with additional partner approvals in progress.
These aren't self-declared badges. Each partner independently reviews our security practices, data handling, and API usage.
Our current compliance status and ongoing security initiatives
Formal gap analysis complete. Active remediation program underway. Target certification: December 2026.
Continuous automated scanning and auditing across the entire platform.
| Job | Schedule | Status |
|---|---|---|
| Daily dependency scan | 7:00 AM ACST daily | Ready |
| Weekly secrets scan | Monday 8:00 AM ACST | Ready |
| Weekly AWS audit | Wednesday 8:00 AM ACST | Ready |
| Weekly code hygiene | Tuesday 9:00 AM ACST | Ready |
| Weekly doc staleness | Thursday 8:00 AM ACST | Ready |
| Weekly ISO 27001 | Friday 10:00 AM ACST | Ready |
| Monthly health audit | 1st of month 10:00 AM ACST | Ready |
VibeCFO has been operating since 2018 — serving 120+ accounting firms managing 800+ client organisations across Australia, New Zealand, the UK, US, and Canada. We process financial data daily across Xero, MYOB, XPM, Reapit, CIN7, and Shopify integrations.
We're not a startup that appeared last month. This is what we do, and we've been doing it for eight years.
