Encryption everywhere
Data is encrypted in transit with TLS 1.2 or above, and at rest with AES-256. Secrets and credentials are stored in a managed key vault with restricted access.
Your ledger deserves grown-up security
This page is maintained by COUNT to answer the security and privacy questions customers and their accountants ask most. We maintain a SOC 2 Type II program and make our latest report available under NDA to customers and prospects.
Controls we operate
Shared responsibility: COUNT secures the platform, and your organisation controls who has access, what they can approve, and how long data is kept.
Access control
Role-based permissions, approval limits, enforced multi-factor authentication and free Google/Microsoft Entra SSO for firms. Access to production data is least-privilege and logged.
Audit trail
Every change to a ledger, job or approval is recorded in an immutable audit log that you and your accountant can review at any time.
Bank connections
Bank feeds use read-only, consent-based connections through regulated aggregation partners. COUNT never stores your online banking password and cannot move money from a feed.
Resilience
Continuous backups with point-in-time recovery, multi-zone infrastructure, and regularly tested restore procedures.
Monitoring and response
Continuous security monitoring, dependency scanning and a documented incident response process with defined customer notification steps.
SOC 2 Type II program
We maintain a SOC 2 Type II program and make the latest report available under NDA to customers and prospects performing due diligence.
Your responsibilities
- Enforce multi-factor authentication for everyone in your organisation.
- Review user roles and approval limits when people join, move or leave.
- Keep your own retention and deletion policy aligned with your obligations.
- Tell us promptly at security@getcount.com if you suspect an account is compromised.
Security questions we're asked
- Where is my data hosted?
- Data is hosted with major cloud providers in the region associated with your organisation. New Zealand and Australian customers are hosted in Australasian regions; US customers are hosted in the United States.
- Can COUNT move money?
- No. Bank feeds are read-only. Payment runs are initiated in your own banking or payment provider, with COUNT preparing the batch for your approval.
- How do I report a vulnerability?
- Email security@getcount.com with details and reproduction steps. We acknowledge reports within one business day and will keep you updated through remediation.
- Do you support SSO and enforced MFA?
- Yes. Multi-factor authentication is available to every account and can be enforced firm-wide; Google and Microsoft Entra ID SSO are included for accounting and bookkeeping firms.
Need a security review pack?
We provide architecture summaries, subprocessor lists and questionnaire responses for firms performing due diligence.