Accounting system security checklist

• Access is scoped by entity and role (preparer, approver, controller, auditor read-only); every query filters by the entities the user holds; an auditor role is read-only and cannot see bank credentials.

• Segregation of duties is enforced in the database and the app: creator is distinct from approver on bills, manual journals and payment runs; vendor bank changes need a second approver and trigger a payment hold; conflicting roles cannot be assigned to one user.
• Posted journals, issued invoices and audit rows are immutable (trigger and revoked grants); closed periods reject postings; corrections are reversals or credit notes that reference the original.

• Bank details and tax identifiers are encrypted at column level, masked in the UI except the last 4, excluded from logs and exports unless the role allows it.

• Flag duplicate bills (same vendor, amount, date window), round-number and just-below-threshold amounts, changed bank details followed by payment, and weekend postings; payment-run release is rate limited and double-approved.

• Bill scans and statement files are type- and size-validated, scanned, parsed in a sandboxed worker, and CSV/OFX cells beginning with formula characters are neutralised on export.

• Financial record retention: Accounting records are kept for 6-10 years depending on jurisdiction; this overrides erasure for those records. Archive, do not delete.
• SOX-style internal controls (applies to listed company or subsidiary of one): Segregation of duties, approval evidence, access reviews and period-close sign-off are the controls auditors test; the audit log and approval tables are the evidence.
• Tax compliance and e-invoicing (applies to operating across jurisdictions): VAT/GST rules, e-invoicing mandates (for example Peppol, Italy SDI, India GST) and sequential numbering vary by country; the app supports codes and numbering but does not file returns or certify tax correctness.
• Accounting standards (applies to statutory reporting): IFRS/GAAP treatment (revenue recognition, leases, consolidation) is a policy decision for the accountant; the app records and reports and is not an accounting adviser.
• Payment fraud and bank file security (applies to paying vendors): Payment batch files and bank details are high-value targets: dual approval, hold on bank change and out-of-band verification are required controls.

• fx rate api calls day: one bulk rate fetch per day; the job refuses to loop and stops at the vendor free tier.
• report snapshots per entity month: capped snapshots; older snapshots are compacted to the last of each period.
• payment run daily ceiling: hard in-code ceiling on total value released per day; refused at 100%, alert at 90%.
• storage gb per org: document and snapshot storage quota; uploads refused at the quota.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as background jobs, file uploads and search are rolling out; email sent from your app is coming soon, so anything here that needs it is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in an accounting system?

Access is scoped by entity and role (preparer, approver, controller, auditor read-only); every query filters by the entities the user holds; an auditor role is read-only and cannot see bank credentials.

Does an accounting system have compliance obligations?

Financial record retention: Accounting records are kept for 6-10 years depending on jurisdiction; this overrides erasure for those records. Archive, do not delete. This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build an accounting system
• Accounting system architecture
• Example prompt for an accounting system
• Accounting system scaling checklist
• Often combined: ledger app
• Often combined: approval workflow app
• All app types