Security overview

We are a small company and we would rather you knew exactly what that means than discovered it later. What follows is what the product actually does, followed by what we do not have.

The shape of it

The connector runs on your server and makes an outboundconnection to our relay. We never connect inward to your network, and you do not open a firewall port for us. If you stop the service, the flow stops; nothing of ours has to agree.

Everything the assistant can reach is read-only against Sage. The connector runs as a Sage user that you create, so your Sage permissions are the real boundary and they stay under your control.

Access and identity

• Assistant connections use OAuth 2.1 with PKCE. Tokens are scoped to one tenant, refresh in families, and revoking one ends the family.
• The connector authenticates with a per-installation credential issued at enrollment.
• Stored credentials are hashed. Secrets on your own server can be held using Windows DPAPI rather than plain text.
• Tenants are isolated from one another, and a request for a tenant you are not entitled to is refused without revealing whether it exists.

In transit and at rest

TLS end to end. The relay sits behind Cloudflare for TLS, filtering and rate limiting, and the origin accepts traffic only through it. Our database holds no Sage business records; answers are cached in memory for a short, per-endpoint lifetime and never written to disk. Backups are encrypted at rest and are not publicly reachable. The detail is in the connector privacy notice.

Logging

Every request is recorded with who asked, which tool, which endpoint and what was decided. Parameter names are recorded with hashed values rather than the values themselves, so an audit trail does not become a second copy of your data. Authentication and authorisation outcomes are logged separately. Retention is 400 days by default.

Updates

Nothing auto-updates on your server. We do not push code into your environment, which means you decide when to apply an update and we cannot surprise you. The trade is that keeping current is a shared responsibility, so we will tell you when an update matters and why.

What we do not have

Stated plainly, because your reviewer will ask and the honest answer is better than a hedge.

• No SOC 2. We are not certified and are not close. What we offer instead is this document, a completed CAIQ-Lite on request, and direct access to the person who wrote the code.
• No published penetration test. The product has been audited internally and findings remediated; an independent test is planned rather than done.
• No GDPR posture claimed. If you need one, ask before you buy rather than after.
• Not yet signed. Installer and binaries are not Authenticode-signed today. That is in progress, and until it lands your allowlisting will see file hashes rather than a publisher.
• A data processing addendum is available to sign on request.

Reporting a vulnerability

security@keywaysystems.com. We will acknowledge within one business day. We do not run a bounty programme and we will not threaten anyone who reports in good faith.