Security at Pratica

Pratica is a multi-tenant platform for accounting firms. Every record your firm creates is tied to your workspace and is never visible to another firm. Below is a plain-language summary of how we keep your data safe, the infrastructure we run on, and where to reach us with a security question or report.

We don't run our own datacenters. Pratica is built on top of vetted, independently audited cloud providers so that world-class security engineering is baked into the foundation:

• Fly.io — application hosting and compute. Fly is SOC 2 Type 2 certified, runs hardware in ISO 27001 datacenters, isolates each tenant in its own lightweight virtual machine (tenants do not share a kernel), encrypts storage volumes at rest, and undergoes third-party penetration tests. See fly.io/security.
• Neon — our Postgres database. Neon is SOC 2 Type II, ISO/IEC 27001 & 27701 certified, and GDPR- and HIPAA-aligned. It encrypts data at rest with AES-256, enforces TLS 1.2+ in transit, takes daily encrypted backups across multiple availability zones, and supports point-in-time restore. See neon.com/security.

Additional processors handle narrow, specific jobs: Cloudflare R2 (file storage), Resend (transactional email such as verification and password resets), Anthropic and OpenAI (optional AI features), and Umami (privacy-focused, cookieless analytics). The full, current sub-processor list lives in our Privacy Policy.

• In transit — all traffic to and within Pratica is encrypted over TLS 1.2+ (HTTPS everywhere). We do not serve the application over unencrypted connections.
• At rest — your database is encrypted with AES-256, storage volumes are encrypted, and sensitive secrets — including any OAuth tokens for integrations you connect — are encrypted at rest.

Pratica is multi-tenant from day one. Every business record carries a workspace identifier, and every database query the application runs is automatically scoped to the workspace of the signed-in user. A firm cannot read, list, or reach another firm's data — the isolation is enforced at the data-access layer, not left to individual screens to remember.

• Passwords are hashed, never stored in plaintext. You can also sign in with Google or a magic link instead of a password.
• Email verification is required so that only the owner of an address can activate an account.
• Role-based permissions within each workspace let firm administrators control who can see and do what, with granular per-user overrides on top of roles.
• Least-privilege access for Pratica personnel: staff access to production is restricted by default and granted only when necessary to operate or support the Service.

Your data is backed up daily in encrypted form across multiple availability zones, and our database provider supports point-in-time restore. These are platform-level durability safeguards: they protect your firm's data against infrastructure failure or catastrophic loss. They are disaster recovery for the underlying systems, not a self-service undo for individual changes or deletions you make inside the app.

Some optional features use AI (for example, suggested to-dos and insights). When you use one, only the data needed for that feature is sent to our AI providers to return a result to you.

• Our AI providers do not use data submitted through their APIs to train their models.
• We do not use your workspace data to train our own or any third party's models.

Pratica is operated from British Columbia, Canada. Our infrastructure providers process and store data in the United States. We handle personal information in accordance with Canada's PIPEDA and Québec's Law 25, and if a breach ever creates a real risk of significant harm we will notify affected users and the applicable authorities as required by law. Full detail — including international transfers, retention periods, and your rights — is in our Privacy Policy.

If you believe you've found a security vulnerability in Pratica, we want to hear from you. Please email security@pratica.ca with the details and steps to reproduce. We will acknowledge your report, investigate promptly, and keep you informed. Please give us a reasonable opportunity to resolve the issue before any public disclosure.

For any question about how Pratica protects your firm's data, reach us at hello@pratica.ca.