Our approach to security
Pluto Suite handles sensitive financial data on behalf of Canadian freelancers and small business owners. Security is built into how the platform is designed, not added on afterward. Below is a plain-language overview of the controls in place.
Encryption in transit
All communication between your device (or browser) and Pluto Suite servers is encrypted using TLS (Transport Layer Security). This applies to the mobile app, the web app at app.plutosuite.com, and the marketing website.
Encryption at rest
- Files and receipts: every file we store in Amazon S3 (receipt images, profile photos, business logos, and database backups) is written with AES-256 encryption at rest. Exported reports are not stored at all: they are generated when you download them.
- Database: the most sensitive fields are encrypted again inside our database with AES-256-GCM before they are stored: bank and integration tokens (Plaid, QuickBooks, Square, Shopify), webhook signing secrets, employee Social Insurance Numbers, and vendor tax numbers. Even if the database were compromised, those values would be unreadable without the encryption key.
Account security and passwords
- Password management: sign-in is handled by Firebase Authentication (Google). Your password is hashed and stored by Firebase, never by Pluto Suite.
- Two-factor authentication (2FA): two-factor authentication is supported. When enabled, a one-time code is sent to your phone number via SMS before sign-in is complete.
- Biometric lock: on supported devices, you can require Face ID or Touch ID to open the app.
- Session management: signing out ends the session on the device you are using. To end every session on every device, for example after losing a phone, use Settings, Security, Sign out of all devices. Changing your password also ends every session.
Bank and card connections
- Handled by Plaid: bank and credit card connections are established through Plaid (US and Canada). Your online banking username and password are entered directly into Plaid's secure interface; Pluto Suite never sees or stores your banking credentials.
- Read-only access: connections are strictly read-only. Pluto Suite can view your transaction history and balances, but cannot initiate transfers, make payments, or take any action on your accounts.
- Encrypted token storage: after you connect a bank account, Plaid gives us an access token for it. We encrypt that token with AES-256-GCM before storing it in our database, and it is only ever sent back to Plaid.
- Disconnect any time: you can remove a linked account at any time from within the app.
Audit logging
Pluto Suite logs sensitive account actions, including: account deletion, role and permission changes, settings changes, locking the books, and export events. Report and data exports are logged with who ran them and the period they cover. Owners, Admins, Accountants and Managers can read the audit log in the app, and each entry is chained to the one before it with a cryptographic hash to help detect tampering with past entries.
Internal access controls
Access to production systems and user data within the Pluto Suite team is governed by the principle of least privilege; team members are granted only the access their role requires.
Monitoring and updates
We monitor errors and uptime continuously. Security updates to our servers' operating system install automatically every day, with a weekly restart window for updates that need one. Dependencies are checked for security advisories every week and updated wherever a patched version is available. All traffic to our API must use HTTPS: plain HTTP requests are redirected or refused.
Disaster recovery and backups
User data is backed up every night on encrypted infrastructure. Backups are stored separately from the primary database and are used to recover from hardware failure or data corruption. An automated drill restores the latest backup every month and checks that every business's ledger still balances.
Vulnerability reporting
If you believe you've found a security vulnerability in Pluto Suite, please report it to us privately before disclosing it publicly. Send details to support@plutosuite.com with the subject line "Security Vulnerability." We will acknowledge valid reports within 3 business days and work to remediate confirmed issues as quickly as possible. We ask that you give us reasonable time to address a vulnerability before public disclosure.
Team and role-based access
For businesses with a team, Pluto Suite supports role-based permissions so each person sees only what's relevant to their role:
- Employee: their own receipts, trips, and shifts, and their team's invoices; no bills, vendors, or bank connections
- Manager: the team's receipts, transactions, invoices, bills and vendors, payroll runs, profit and loss and cash flow, and can lock the books; they can view connected bank accounts but not connect or disconnect them, and have no ledger or billing
- Accountant: everything a Manager can do, plus the ledger, bank connections, tax reports, and billing. An external accountant (someone outside the business you invite to keep your books) has no access to payroll
- Admin: full access except a few Owner-only actions
- Owner: complete control, including downgrading the plan and unlocking a locked period
Roles rank in that order, so an Accountant can do more than a Manager.
Questions
For any security-related questions or to report a concern, contact us at support@plutosuite.com.