Security

Your accounting data deserves better than shared passwords and long-lived tokens in scripts. Exact Gateway is built so that every consumer gets the least access it needs, and nothing leaks when something goes wrong.

Least privilege by default

• Every API key and connected app starts with no access. You grant data types, actions (read, write, delete) and administrations explicitly.
• Writes and deletes need their own permission; a read-only key can never change data.
• Administrations are off until an administrator enables them.

Strong sign-in

• Passwords hashed with Argon2id; sign-in throttling and account lockout.
• Two-factor authentication is required for administrators and for authorizing apps.
• Sessions in secure, HTTP-only cookies that are revoked on password change.

Encryption

• Exact Online tokens, OAuth tokens and cached data are encrypted at rest (AES-256-GCM with versioned keys). Each value is bound to its own record, so a copied value is useless elsewhere.
• API keys are shown once and stored only as a hash.
• All traffic uses TLS.

Pass-through, not storage

By default your Exact data passes through the gateway without being stored. The optional cache keeps encrypted copies in memory for at most the time you choose (up to 24 hours) and is erased when you switch it off, disconnect Exact or disable an administration.

Transparency

• An audit log per organization: sign-ins, permission changes, Exact connections, connected apps and every denied request.
• Connected AI apps are listed and can be revoked instantly.

Infrastructure

• Hosted in the EU. Containers run without privileges on read-only file systems.
• Dependencies and images are scanned for vulnerabilities every day.

Roles

For your data, you are the controller and MVdW-Software is the processor. See the data processing agreement. Found a vulnerability? Mail info@mvdw-software.com.