Security

Last updated: 21 October 2026

This page answers the questions security reviewers ask, in plain language and without overstatement. synthetic cfo is operated by a single founder and this page says exactly what is and is not in place. Nothing here is aspirational.

The data itself carries no risk

• Born synthetic. Every dataset is generated from deterministic accounting rules. No real company data, no real transactions and no real people exist anywhere in the system. Names, vendors and customers come from synthetic pools.
• No language model produces any data. The engine's first rule is that an LLM may only translate a request into a validated configuration. Every generated field, including the written audit reasoning, comes from deterministic Python. There is no mode in which this is different.
• Reproducible and verifiable. The same seed and configuration regenerate a package byte for byte on the same engine version; a newer engine builds a different dataset from the same seed. Every package generated on an account ships a certificate naming the engine version and listing the SHA-256 of each file, so integrity can be checked by anyone holding the package; the watermarked public sample leaves it out, because the watermark changes the PDF and workbook bytes.

What we store about you

• Your account email, a salted password hash (PBKDF2-SHA256, 200,000 iterations; social sign-ins store no password at all), your plan, display name and generation preferences.
• Your generation history as seed plus configuration, which is what lets you regenerate any package (byte for byte on the engine version that built it). Generated package files live on our storage until you delete them or they are reclaimed.
• Your chats only if you turn on chat sync; otherwise they stay in your browser.
• Monthly generation counts on the free plan, and reviews you choose to submit.
• A record of every email we send to your address: which email, its subject, when it went and whether it was delivered, with your What's new choice and the list of addresses that have stopped our emails, which is what stops us writing to you again.
• The notices in your bell and, where you switch push on, the push subscription for that device.
• We do not process payments on the platform today, we run no advertising or tracking cookies (one strictly necessary session cookie signs you in), and we never see real financial data because none exists here.

How the service is protected

• Traffic is encrypted in transit with TLS. Hosting and storage run on managed cloud infrastructure provided by Railway; transactional, follow-up and What's new email is sent through Resend, What's new and the email when the sample changes from a separate news address; social sign-in tokens from Google, Microsoft and GitHub are verified server side.
• Sessions use httponly, same-site cookies with a short idle timeout. Rate limiting guards sign-up, sign-in, reset and generation endpoints.
• Administrative surfaces are locked to the owner account.

Backups and continuity

• The account database is snapshotted daily, session tokens and per-reader article rows are removed from the copy, the dump is encrypted with AES-256 using a key held only by the owner, and an off-platform copy is delivered automatically. The email send log, the What's new choices and the list of addresses that stopped our emails stay in the copy on purpose, so a restore cannot resurrect mail to someone who objected. The restore procedure is documented and has been rehearsed against a real backup.
• Generated packages are not backed up: each is regenerable from its stored seed and configuration, byte for byte on the engine version that built it, which is the product's core guarantee; on a newer engine the same seed and configuration build a different dataset.

Deletion and retention

• You can delete your account yourself from the account page. Deletion permanently removes your account, chats, preferences, usage records and every generated package.
• Contact, demo and sample records that never became accounts are deleted automatically after 24 months, as described in the Privacy Policy.

A signable data processing agreement

Customers on a paid plan who need a signed DPA for vendor onboarding can read the full text at app.syntheticcfo.com/dpa. It commits to exactly what this page describes, names the sub-processors the Privacy Policy discloses, and is executed by email with both parties' legal details completed at signature.

What we do not claim

Reporting a vulnerability

If you find a security issue, email us and you will get a human reply. We ask for reasonable disclosure time and we will credit you if you want credit.