Security

Embla is built for UK accountancy practices. Our database, sign-in and file storage are recorded as London, UK. Where the application's computing runs is not yet confirmed. Live region still to re-check

Other companies process data only for the job named below. Several are used only when the feature that needs them is switched on, by a practice or by Embla for every practice. Some of those companies are outside the UK, including in the USA. We do not claim that no personal data leaves the UK.

• Google (Chrome) — Your browser's own speech service, used only if you press Dictate (USA/global)
• Microsoft (Edge) — Your browser's own speech service, used only if you press Dictate (USA/global)
• Apple (Safari) — Your browser's own speech service, used only if you press Dictate (USA/global)
• Supabase — Database, authentication and file storage (London, UK)
• Vercel — Application hosting and content delivery (EU/global edge network)
• Resend — Transactional email delivery (proposals, links, notifications) (USA)
• Companies House — Public company-data lookups on a client's behalf (UK)
• GoCardless — Direct Debit mandate setup and collection (UK/EU)
• Xero — Per-client accounting-data access where a practice connects it (EU/global)
• SignWell — Engagement-letter e-signature (where enabled) (USA)
• Anthropic — Optional AI assistance over documents and text (where enabled), including reading the handover documents a practice uploads to fill in a client's record, and writing a short summary of a client from the facts and notes held about them when a colleague asks for one, when the practice switches that on. Also asked the practice's own search questions for the visibility checks (where enabled). Also drafting the About this client note from the entity type, the stage, the services, the year end, the Companies House sector and a contact's first name only (no free text), when the practice switches that on and a colleague presses Draft with AI. Nothing is saved until the colleague saves it (USA)
• OpenAI — Asked the practice's own search questions for the visibility checks (where enabled); no client data is sent (USA)
• Google (Gemini) — Asked the practice's own search questions for the visibility checks (where enabled); no client data is sent (USA/global)
• Perplexity — Asked the practice's own search questions for the visibility checks (where enabled); no client data is sent (USA)
• Google Search Console — Search statistics for the practice's own website (where enabled); the site address is sent (USA/global)
• Microsoft Bing Webmaster — Search statistics for the practice's own website (where enabled); the site address is sent (USA/global)
• HMRC (VAT number check) — Checks a client's VAT registration number is valid (where enabled); the VAT number is sent (UK)
• Google (Places) — Finds a prospect business's public listing for prospecting (where enabled); the business name and town are sent (USA/global)
• LinkedIn — Posts an approved case study to the practice's own LinkedIn page, only with the client's recorded consent (where enabled); the case study's title and text are sent (USA/global)
• Microsoft (Graph) — Shared-mailbox routing of client email, and copies of documents into a practice's SharePoint or OneDrive (where enabled) (EU/global)
• Dropbox — Per-client document folders, and copies of documents into the practice's own Dropbox (where enabled) (USA/EU)
• Twilio — SMS delivery for the assisted-digital channel (where enabled) (USA/global)

Embla does not send anything it reads from Xero to an AI provider.

List still being checked against what the code calls

Each practice's records are kept apart from every other practice. A person signed in to one practice cannot read another practice's clients, documents or history. If someone calls the database directly with their own sign-in, it shows no client, document or history until the second sign-in step is passed. The one thing shown before is their own staff profile.

Inside a practice, people are one of four kinds: a principal or owner, a senior accountant, a junior or bookkeeper, or an outsourced provider. The kind sets what they can do. A principal can narrow or widen that for one person. Some work stays with a principal unless they hand it on, including changing the practice's settings and bringing a client book across.

Staff cannot use Embla on a password alone. After the password they must set up an authenticator app, and every page and action that shows client data checks that the session has completed that second step.

A practice can let colleagues connect their own AI assistant, in beta. It is read-only, off until a principal switches it on, and limited to what that one colleague could see on screen. Every question it asks is logged. It is never given tax references, bank details or anti-money-laundering reasons.

Embla keeps a record of who did what, and when, in UTC. The database rejects any change or deletion of an entry made through the application. A correction is written as a new entry. The original stays.

It does not hold the contents of a document or an email. Entries can include details such as a file name or an email address, and entries made before 29 September 2026 may hold more.

Files travel over HTTPS. The site tells browsers to keep using HTTPS.

A document is not handed out as a standing web address. A download goes through Embla, which checks who is asking and that they belong to the same practice as the file. Staff must have completed the second sign-in step. A client can download only a file on their own record, and only with their own sign-in link. The address they are then sent lasts about a minute. Each download is normally recorded when the link is issued; if recording fails, the download is not blocked.

Staff cannot read client files straight from storage. Live storage rules still to re-check, including one bucket created by hand Stored files are encrypted by the storage service as part of how it keeps them. Storage encryption setting still to re-check

Messages Embla sends use a fixed layout: either Embla's own wording for system messages, or the practice's template for that kind of message, with the client's details filled in.

One switch stops the email Embla itself sends. Signing requests from our e-signature provider, and the sign-up invitation from our sign-in provider, are not covered by it.

A change to how data is stored is fingerprinted when it is written. A change that has already been applied to the database cannot be edited afterwards unless someone decides, deliberately, to allow it. Applying changes to the live database waits for a named approval.

Every change is run through these automated checks before release: the style rules with no warnings, the types, the automated tests, and a production build.

We do not yet publish a recovery time, or how far back the live database can be restored. Database backup terms still to confirm

Embla is not yet certified to SOC 2 or ISO 27001, and has not been independently audited against either. We have not yet carried out a penetration test. We will say so plainly until a certificate exists.

If you find a security problem, email joe@fintone.co.uk. Please do not include a client's documents or personal details in the first message. We will tell you where to send anything we need to see.