Security and privacy
Your books, your keys, your customers' details.
GoSmoko holds the commercially sensitive middle of your business: what you charge, who you charge, and the keys to your accounting and payment providers. Here is exactly how each of those is protected.
Credentials encrypted at rest
Every API key and OAuth token is encrypted with AES-256-GCM before it is written to the database. The encryption key lives in the environment, not the database, so a database copy on its own is useless.
One business, one boundary
Every record carries the business it belongs to, and every query is scoped to the signed-in user's business. There is no shared table you can read across by guessing an ID.
Keys are write-only
Once saved, an API key is never shown again, not to you, not to support. The interface shows a masked hint so you can tell which key is in place without exposing it.
Customer links, not customer accounts
Quotes and invoices are shared through an unguessable random token. A customer can view, accept, decline, or pay without an account, and the link exposes that one document and nothing else.
Webhooks are verified, not trusted
Stripe payment notifications are checked against your own signing secret with a timing-safe comparison and a timestamp window, so a forged or replayed call cannot mark an invoice paid.
Integration safety
Least access, always revocable
We ask providers for the narrowest permission that makes the feature work, and we make it easy to take it back.
- Xero is connected through its own sign-in screen. We never see or store your password.
- OAuth state is signed and single-use, so a connection request cannot be forged or replayed.
- Access tokens are refreshed automatically and re-encrypted each time; an expired connection surfaces as 'Reconnect' rather than failing silently.
- Stripe keys are validated the moment you paste them, so a wrong or revoked key is caught before an invoice depends on it.
- Every sync writes an activity entry, giving you an audit trail of what was pushed, pulled, and rejected.
Questions
Security FAQ
Where is my data stored?
In a managed Postgres database with encryption at rest and automated backups. Your business data is never shared with other customers and is never used to train models.
Can GoSmoko staff see my invoices?
Our founders' console shows each business's plan, usage and invoice totals, so we can bill you and spot a problem early. We open your jobs, customers or invoice detail only when you ask us to look at something. Nobody at GoSmoko views your stored integration credentials. They are encrypted and only decrypted to make a call for your business.
What happens when I disconnect an integration?
The stored credentials are deleted immediately, not flagged as inactive. Records already pushed to Xero or Stripe stay in those systems, because they are your records in your accounts.
Is the AI reading my customer data?
Talk it out and file drops send the text you brought in to your configured AI provider, so it can extract fields. To get names and prices right it also sends a short memory of your business: customer names and suburbs, open job titles, your charge-out rate and your stock names and prices. Talk it out adds what is on the screen you used it on, such as the lines of the invoice you have open. A voice take goes to the same provider to be turned into words, with your customer and part names so they come out spelled right, and the recording is not kept. Asking @Smoky in a job chat sends that chat, your name and the job's open to-dos and logged parts. The chat mic sends your recording to be turned into words, and the recording is not kept. Nothing else is sent, and nothing is retained for training.
How do you handle GST and record-keeping obligations?
Invoices are issued with sequential numbering generated atomically, so numbers are never reused or skipped under load. That matters for IRD and ATO record-keeping, and it is why we do not renumber documents after the fact.
Do you support two-factor authentication?
Not for your account yet. Today you sign in with email and password, so use a long one you do not use anywhere else. Two-factor sign-in already protects our founders' console, and two-factor for every GoSmoko account is on the roadmap.
Found something that looks wrong?
We would much rather hear about it than not. Email security@gosmoko.com with what you found and how to reproduce it. We will confirm receipt within two business days and keep you updated until it is closed.
Sensible defaults, out of the box.
You should not have to configure security. Start the trial and it is already set up this way.