Security is the product, not a feature.

Security at a glance

Data protection & encryption

Data is encrypted in transit using TLS on every connection to the application and its APIs; there is no unencrypted access path. Data is encrypted at rest: our managed Postgres database and object storage encrypt stored data at the infrastructure layer, and secrets such as connected-service credentials receive an additional layer of application-level field encryption so they are never stored in plaintext.

We follow the principle of least data: TudoIQ reads from connected systems (for example, your accounting or Microsoft 365 environment) only with your explicit authorization, through the provider's official OAuth consent — we never ask for or store your provider password.

Authentication & access control

TudoIQ supports federated single sign-on through Microsoft Entra ID and Google Workspace, so your team authenticates against your own identity provider and your existing conditional-access and MFA policies apply. Where a magic-link email sign-in is used instead, a second factor (TOTP) is mandatory.

Inside the product, access is role-based. Client-portal users are scoped to Executive, Department Head, or Viewer roles; company financials are restricted to executives, departmental data is scoped to a user's department, and approvals enforce segregation of duties — a user cannot approve their own request. Staff and client access are separate authentication domains.

Tenant isolation

TudoIQ is multi-tenant, and isolation is enforced where it counts — at the data layer, not just in application code. The ledger, the subledgers, banking, the close, people records and portal identity all carry Postgres row-level security in FORCE mode, with a policy keyed to the tenant set on the connection for that request. Application queries run as a restricted role that cannot bypass those policies, so a request executing in one client's context is structurally unable to read or write another client's rows. A small number of cross-tenant catalog and token tables sit deliberately outside that boundary — the client switcher's index and the magic-link store, which by definition must be read before a tenant is known. They carry no row-level security by design, are never granted to the restricted role, and are reachable only through a separate connection used by two tightly scoped services. This is the control that matters most for a shared SaaS handling multiple clients' books, and it is worth being exact about where it starts and stops.

Auditability & logging

Sensitive and financial actions are written to an append-only audit trail attributed to the acting user, with a timestamp. Period-close records are immutable once closed. This gives firms a defensible record of who did what and when — important both for internal controls and for their own auditors.

Infrastructure & hosting

TudoIQ runs on managed cloud infrastructure in the United States. Compute and the primary Postgres database are hosted on Render; file attachments are stored in Cloudflare R2 object storage; transactional email is sent through Resend. TLS certificates are managed and auto-renewed. We do not operate our own data centers.

Subprocessors

We use a small set of established infrastructure providers to operate the service. Each is bound by its own security and data-processing commitments.

We will notify customers of material changes to this list. To receive change notices, email security@tudoiq.com.

Data retention & deletion

Customer data is retained for the life of the account and for a limited period afterward to allow for reactivation and to meet legal and financial record-keeping obligations. On written request, we will export a customer's data and delete it from active systems, with backups aging out on their normal cycle. Deletion requests: privacy@tudoiq.com.

Availability & resilience

The managed Postgres database is backed up by our infrastructure provider with point-in-time recovery. We monitor application health and errors. Our target is high availability during business hours across North American time zones; a formal SLA is available to enterprise customers on request.

Compliance & roadmap

We design to recognized control frameworks and are transparent about where we are:

• In place Encryption in transit & at rest, per-tenant row-level isolation, SSO, mandatory 2FA, role-based access with segregation of duties, and audit logging.
• In progress SOC 2 Type II readiness — control documentation and a continuous-monitoring program are underway. We do not claim certification we have not yet earned; a report will be shared with prospective customers under NDA once available.
• In progress Formal privacy program aligned to GDPR/CCPA principles (data-subject requests, DPA available to customers).

Report a vulnerability

We welcome reports from security researchers and customers. If you believe you've found a vulnerability, email security@tudoiq.com with the details and steps to reproduce. Please give us a reasonable window to remediate before any public disclosure. We commit to acknowledging reports quickly and keeping you updated on the fix.

Company. TudoIQ is operated by Lucro Financial Inc, 4808 S Forrestville Ave, Chicago, IL 60615. General contact: info@tudoiq.com.