SECURITY BUILT INTO YOUR WORKSPACE

Private records.
Deliberate control.

Your business data deserves careful handling. Karvilo combines company-specific access, protected connections and a reviewable financial workflow.

01 / ACCESS

Your company stays your company.

The server checks signed-in identity and company membership before granting access to records. Company permissions apply to API actions and private files.

  • Company-specific records and file access
  • Owner, administrator, accountant and viewer roles
  • Action permissions checked on the server
02 / CONNECTIONS

Secrets are handled with care.

HTTPS protects data in transit. Amazon connection credentials and source archives use application-level AES-256-GCM encryption with context binding.

  • Credentials excluded from browser responses and finance exports
  • Short-lived, one-use authorisation state
  • Account disconnect removes the saved refresh token
03 / REVIEW

Important actions have a clear path.

Review records before posting, set approval thresholds and close accounting periods. Reopening a closed period requires a recorded reason.

  • Reviewed imports and explicit journal posting
  • Balanced-entry and duplicate-record checks
  • Permissions and period locks protect the books
04 / TRACEABILITY

A record of the work.

Company audit events preserve the action, actor and revision context. Integrity checks help verify book snapshots before recovery.

  • Company-specific audit records
  • Manual book snapshots with integrity verification
  • Book restoration into a separate company preserves the original
05 / FILES

Checks before data enters the books.

File and import handling applies size, row and structure limits, content checks and parameterised database queries.

  • Mapped fields, validation and duplicate review
  • English PDF/image text extraction runs locally in the browser
  • Source attachments stay behind company access checks
06 / EXTERNAL DATA

Purposeful connected access.

Amazon access is limited in code to finance and reporting operations. Finance imports and synchronisation do not send their records to an AI provider.

  • Protected finance-report authorisation flows
  • Buyer contact fields discarded from Amazon tax and order imports
  • Optional live AI has a separate activation and data scope

YOUR DATA. YOUR QUESTIONS.

Talk to the team.

For access, export, deletion or security-related help, contact the Karvilo team. Share sensitive records through the private workspace or an agreed secure channel.

Get supportRead the privacy notice

A CLOSER LOOK

Karvilo workspace

Actual product interface with illustrative records. Views may evolve as improvements ship.