Read this page to see how Sureshake protects your account and data, and what you can do to keep your own access tight.
Signing in
Sureshake uses Privy for sign-in. When you call a protected API route with a sign-in token, the API verifies that token before it continues.
Shared reports
Before a non-owner can read a report, Sureshake checks that they hold access that is accepted, not revoked and not expired. As the owner, you can add these protections to a share under Access protection:
- Passcode. The recipient enters it before opening the report, and once every 12 hours after that. Sureshake stores only a hash of the passcode. Five wrong attempts lock the reader out for 15 minutes.
- Email match. When you share with an email address, a switch labelled Only and that address refuses anyone who opens a forwarded invitation from a different account.
- NDA. The recipient signs with their name before reading. The acceptance is recorded and anchored.
You can also turn off downloads and watermark pages. See sharing.
API keys
- Sureshake shows a new key only once, so copy it when you create it.
- Sureshake stores a hash of the key rather than the key itself.
- Keys can have an expiry date and can be revoked.
- API requests are rate limited.
See authentication.
Accounting connections
Sureshake’s reporting connectors read from QuickBooks and NetSuite. The reporting flow doesn’t post, edit or delete entries in your books.
That limit is set by Sureshake’s software, not by the provider’s permission. QuickBooks grants Intuit’s accounting scope, which also allows writing, so review the permission screen when you connect.
You can disconnect QuickBooks or NetSuite from its connection card at any time.
Data in transit and in storage
- Connections to the website are served over HTTPS, and plain HTTP redirects to it.
- Files in document storage are held in Amazon S3 with server-side encryption.
What goes on a public blockchain
Sureshake publishes fingerprints and proofs on Base rather than documents or figures. Some metadata is public on IPFS. See How proof works before you mint a report.
Keep your own access tight
- Give people only the company roles they need, and remove people who have left.
- Revoke external shares you no longer need.
- Use a passcode and the email match for sensitive reports, and send the passcode separately.
- Give each API key an expiry date, and revoke keys you no longer use.
Report a security problem
Email security@sureshake.com with what you found and how to reproduce it.