Security
How we protect your business and your clients’ data. Questions? access@expensedeskpro.com.
Data protection
- All traffic is encrypted in transit with TLS. Data is encrypted at rest by our infrastructure provider.
- Files and receipts live in private storage, scoped per business — never publicly listable.
- Each business’s data is isolated by row-level security in the database, enforced on every query.
Access control
- Role-based access: owners and admins see everything; field/crew accounts are restricted to jobsite tools and cannot read financials, payroll, or invoices — enforced at the database level, not just hidden in the UI.
- Two-factor authentication (TOTP) is available on every account.
- Client portal access is read-only, per-job, and granted explicitly by the contractor.
Accountability
- An automatic activity log records who changed what, and when, across jobs, invoices, payments, and more.
- Server-side error monitoring and rate limiting protect against abuse and surface issues quickly.
Your data, your control
- Export all of your business data as a single file at any time.
- Delete your account and erase your data permanently, on demand.
- We never sell your data, and we never send email on your behalf — invoices and reminders open in your own email app.
Payments
- Subscription billing is handled by Stripe; we never see or store your card number.
ExpenseDesk Pro is a record-keeping tool, not a substitute for a licensed accountant, tax preparer, or attorney. · System status · Privacy · Terms