Security

Every record belongs to one firm. Row-level security in the database stops other firms from reading it, and automated tests check this on every change.

Sign-in uses one-time email codes; no passwords are stored by Recoready.

Statement PDFs are kept in a private bucket and opened only through short-lived links for signed-in members.

Status changes such as approval and export happen inside the database, so they cannot be skipped from a browser.