Last updated: October 12, 2026
This page describes how Park Four, LLC secures this instance of FOQB and the data it holds, including bank data accessed through Plaid. It is a description of actual current practice, not a certification or a claim of formal accreditation.
Park Four, LLC is responsible for the security of this instance. This document is our information security policy: it is reviewed and updated whenever practices described here change, and the “Last updated” date above reflects the most recent revision. Written operating procedures implement it (access management, change management, key rotation, incident response, vulnerability management, and backup and recovery) and are available on request.
All traffic to the Service is encrypted in transit (TLS). Bank access tokens returned by Plaid are encrypted at rest before storage and are never logged or exposed in plaintext outside the request that decrypts them for an active API call.
Each organization’s data is isolated from every other organization’s at the database level (Postgres Row Level Security), enforced independently of application code — a bug in application logic cannot by itself expose one organization’s data to another. Account roles (owner, accountant, viewer) gate what a member can read or change within their own organization. Two-factor authentication (TOTP) is available to every account from Settings, and is required to connect or reconnect a bank account. Once enabled, the database itself refuses a session that hasn’t completed the second factor. Connecting banks can be turned off for this whole instance, or by an organization’s owners for their organization.
Every code change runs through an automated pipeline — type checking, linting, and unit, component, and database integration tests — before it can reach production. No change is deployed without passing that gate.
Changes to accounting records and organization membership are recorded in an audit log visible to members of the affected organization. Administrative actions taken by Park Four, LLC on an organization’s behalf are separately logged.
This instance runs on Vercel (application hosting) and Supabase (database and authentication). Bank connections are provided by Plaid, Inc. All three are established providers with their own independent security and compliance programs.
We collect only what the Service needs to function. Deleting an organization permanently removes its records, retaining only the organization’s name and deletion date. See our Privacy Policy for the full data lifecycle.
If you believe you’ve found a security issue affecting this Service, email paul@parkfour.com with details. We investigate reports promptly and will notify affected organizations directly if an incident is confirmed to have exposed their data.
We perform our own internal security review of the codebase on an ongoing basis. An independent third-party security assessment has not yet been completed; it is planned as the Service and its user base grow.