Plain answers about your data.
OnDue connects to your books and writes to your customers. You should know exactly how it’s built, including what it doesn’t have yet.
What we do today
- In transit
- Every connection to OnDue, and from OnDue to QuickBooks and Xero, uses TLS.
- At rest
- OnDue’s own data (accounts, teams, settings, stop-chasing records) is stored in Amazon DynamoDB, encrypted with a customer-managed AWS KMS key that only OnDue uses, rotated yearly.
- Ledger tokens
- The access tokens that let OnDue read your QuickBooks or Xero company are sealed with AWS KMS envelope encryption (AES-256-GCM). They are never sent to your browser.
- Sign-in
- Passwords of at least 12 characters, eight-digit email codes that expire within 15 minutes, and optional authenticator-app two-factor sign-in with one-time recovery codes.
- Access
- Each part of OnDue runs with its own narrowly scoped permissions; only the part that talks to your books can reach the ledger connection. Inside your account, owners manage settings and the team; members can approve, skip and stop chasing.
- Audit trail
- Every approval and skip is recorded with who made it and when, and every change in your account is logged with the person who made it.
- Hosting
- Amazon Web Services only, in the United States (us-east-2, Ohio).
- Your accounting login
- You sign in to QuickBooks or Xero directly. OnDue never sees the password, and you can revoke access from their side any time.
What we don’t have yet
OnDue is new. We’d rather say so than let a badge imply otherwise. If your procurement process needs something specific, email security@ondue.ai and we’ll tell you straight whether we can meet it.
- Third-party certification
- OnDue holds no independent security certification or attestation today. If you need one, ask us for our security questionnaire answers and we’ll tell you straight what we can and can’t show.
- Card and bank details
- The Stripe pay page is coming soon. When it launches, customers will enter card and bank details on a Stripe-hosted form; OnDue will get the result, never the numbers.
- SSO and SCIM
- Single sign-on and user provisioning for larger teams.
- Finer roles and approval rules
- More than the owner and member roles, for teams with several people chasing.
Questions
Does OnDue have a security certification?
No. OnDue is new and holds no third-party certification or attestation. Ask for our security questionnaire answers at security@ondue.ai.
Does OnDue store card or bank details?
No. OnDue doesn’t take payments yet. When the Stripe pay page launches, customers will enter them on a Stripe-hosted form and OnDue will receive the payment result, not the numbers.
What can OnDue change in my QuickBooks or Xero company?
Nothing today: it only reads. When the pay page launches, it will record payments taken there against the right invoice. It doesn’t create, edit or delete invoices.
How do I report a security issue?
Email security@ondue.ai. We read every report.