Your books, defended in depth

Most financial-software incidents are not break-ins. They are ordinary people making changes — a price overridden, an invoice reopened, a period quietly adjusted — and nobody able to say afterwards what the numbers were before.

When a document is corrected here, its previous journal lines do not disappear. They move to the audit trail marked replaced, carrying the document, the timestamp and the user who did it. The ledger stays clean to read while the history stays complete to review, and neither can be quietly rewritten.

Hiding a button is not access control. Every permission in SeroBooks is checked twice: the interface hides what a role cannot see, and the server refuses what a role cannot do — the same View/Allow tree evaluated in both places, with the server as the authority.

The practical test is revocation. Withdraw a permission while a till is mid-shift with the screen already open, and the next attempt at that action fails — the device obeys the server rather than its own cached opinion. Approvals for sensitive actions re-verify server-side rather than trusting the client that asked.

Period locks are enforced at the ledger itself, not as a flag a screen respects. Nothing posts into a closed month — not a backdated invoice, not an edit, not an import, not a recurring template, which skips a closed period rather than writing into it.

That matters because the alternative fails silently: a lock implemented in the interface is bypassed by every other write path in the system, and the discovery usually arrives with an accountant asking why a signed year moved.

Devices keep a local database and the server keeps the truth. A stolen or failed till is a hardware problem rather than a data problem — sign in elsewhere and the business is there. A cloud outage costs convenience rather than a trading day, because the counter keeps selling and syncs when the line returns.

Documents created offline carry idempotency keys, so reconnecting after an outage never duplicates a sale — a quiet detail that prevents one of the more expensive kinds of data corruption.

Exports are built in, and the QuickBooks Desktop bridge moves invoices, credit notes, payments and settlement journals into a company file — reconciled account-for-account in production. The ability to leave is part of the security posture: data that cannot be extracted is data held hostage, whatever the marketing says.

We publish capabilities rather than badges. Formal compliance certifications are on the roadmap and will be announced when they are audited, never before — a claimed certification is worth less than an honest architecture description, and costs far more when it turns out to be aspirational.