Privacy policy

1. Who we are and what this covers

TBKit is provided by WITTCO LLC (“WITTCO”, “we”, “us”), headquartered in Lacombe, Louisiana, and operated from the United States. This policy covers the TBKit service (the web application at app.tbkit.com, its API at api.tbkit.com and its sign-in page at auth.tbkit.com), the TBKit Windows app when we provide it, the public website at tbkit.com, and communications with us about TBKit. Our terms of service explain the rules for using TBKit. If you use TBKit from outside the United States, you understand that we process information in the United States.

WITTCO’s managed IT website at getwittco.com has its own privacy policy. This policy does not cover that site.

2. Our role

Books and records customers put into TBKit. Bookkeeping firms and businesses (“customers”) decide what books and records to put into TBKit and who may see them. For that information, WITTCO acts as a service provider, also called a processor, on the customer’s behalf: we process it only to provide, secure and support TBKit, following our terms and any agreement with the customer. If your information appears in a business’s books, for example as an owner, employee, customer, vendor or payee, please contact that business or its bookkeeper with questions or requests. We will help them respond.

Accounts, sign-in, security, support and our website. WITTCO decides how to handle this information and is responsible for it as described in this policy.

3. Information we handle

• Account and sign-in information. TBKit sign-in runs on Amazon Cognito. Your sign-in profile holds your email address, your name if provided, whether your email address is verified, and a unique sign-in identifier. If you sign in with Google, Google shares your Google account identifier, name, email address and whether Google has verified it, through the openid, email and profile permissions. If we create a TBKit sign-in for you, Amazon Cognito handles your password and your authenticator-app setup; WITTCO cannot see your password. Anyone with a Google account can complete Google sign-in, which creates a sign-in profile and a session, but that gives no access to any books until WITTCO links it to a TBKit user at a customer’s request.
• Access records. Which sign-in belongs to which TBKit user, which organizations each user can access, and with what permissions (read-only, read-and-write, or period closing).
• Web session information. When you sign in to the web app, we keep a session record in our database. It holds the sign-in tokens Amazon Cognito issues and the identity details in them, encrypted. Your browser holds only an opaque reference to that record. The web app’s access token lasts 15 minutes. The renewal token stored with the session expires within 7 days. Signing out removes the session from TBKit and asks Amazon Cognito to revoke that token. If Cognito cannot be reached, or refuses the request, the token can remain usable at Cognito until it expires.
• Books and records. What customers put into TBKit: organization names, charts of accounts, journal entries and memos, period-close dates, bank and card account profiles (institution name and last four digits), imported bank transactions (dates, amounts, descriptions, payee and reference details) and the decisions made reviewing them, reconciliation reports, and reports run from the books. TBKit records which user made each change and when. Depending on what is entered, these records can include personal information about people connected to a business, such as owners, employees, customers, vendors and payees.
• Uploaded bank files. CSV, OFX and QFX bank and card files, up to 5 MB each. TBKit encrypts an uploaded file while it is held for review, and deletes the original file when the import is accepted, or shortly after the review expires 24 hours later if it is not. Accepted transactions become part of the books. For OFX and QFX files, TBKit keeps the full bank or card account identifier from the file in a protected record that only users who can edit that organization’s books can see, so it can match later files to the right account. Elsewhere in TBKit, and in data exports, only the last four digits appear.
• Technical and log information. Our load balancer records each request to app.tbkit.com and api.tbkit.com: the time, your IP address, the address requested, the response, data sizes, your browser’s user agent and connection security details. The requested address can include search text you typed, such as a payee name, and a one-time sign-in code. Our application and database logs record operational events and errors. Administrative logs include organization names and sign-in identifiers, and database error messages can include values from the records involved. Amazon Cognito processes sign-in requests, including IP address and browser information, to sign you in and protect accounts. Our application also uses IP addresses, without storing them, to limit repeated requests to its public sign-in and status addresses.
• The public website. tbkit.com has no forms, scripts, analytics or cookies. Amazon CloudFront processes request information such as your IP address and browser details to deliver its pages. We have not turned on access logging for the website.
• Messages you send us. If you email or call WITTCO about TBKit, we receive the contact details you use and anything you include. Please do not send passwords, full account numbers or other secrets.
• The Windows app. When we provide the TBKit Windows app, it keeps its data, settings and local logs on your PC in your Windows user profile. Unsaved work it keeps for crash recovery is encrypted for your Windows user. Its local logs are written not to include books data or sign-in secrets, and the app does not send usage data to us. The app signs you in through your system browser, using an authorization code and PKCE. It does not use an embedded browser. Access and ID tokens stay in the app’s memory. The refresh token is sealed for your Windows user and stored on that PC; it lasts up to 30 days and is replaced when it is renewed. Signing out removes that saved sign-in from the PC and asks Amazon Cognito to revoke the refresh token. If Cognito cannot be reached, the refresh token can remain usable until it expires. Uninstalling the app removes the saved sign-in from the PC and does not contact Cognito, so that token expires on its own. The app does not point you to a website to do your work. Update checks are off until WITTCO hosts an update feed. When they are on, a check sends your IP address and the app version to that server, and may include a random identifier the updater uses to stage a rollout.

Google sign-in does not give TBKit access to your Gmail messages, Google Drive files, contacts, calendar or Google password. TBKit’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

We use the information described above to:

• provide and operate TBKit, including storing, calculating, reporting on and exporting books;
• sign people in and check, on every request, that they currently have access to the organization they are working in;
• keep TBKit and its data secure, including preventing misuse and investigating problems and suspected incidents;
• keep backups and recover the service after a failure;
• provide support when you ask for it;
• tell account contacts about changes, maintenance and security matters; and
• comply with legal obligations and enforce our terms.

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are used in U.S. state privacy laws. We do not show advertising or build marketing profiles. We do not use Google account information, or customers’ books, to train artificial intelligence models.

5. Cookies and browser storage

The TBKit web app at app.tbkit.com uses only cookies that are strictly necessary for signing in and keeping your session secure:

• __Host-tbkit-session holds an opaque reference to your sign-in session. The session ends when you sign out, after 30 minutes without activity, or 8 hours after you signed in, whichever comes first. Activity extends the 30-minute idle time. It does not extend the 8-hour limit.
• __Host-tbkit-csrf protects your session against cross-site request forgery.
• __Host-tbkit-correlation. and __Host-tbkit-nonce. cookies are short-lived and used only while completing a sign-in.

The web app also saves one setting in your browser’s local storage, tbkit.mode, to remember whether you last used the Bookkeeper or Client view. That setting is not sent to us as a separate record. The sign-in page at auth.tbkit.com is run by Amazon Cognito and uses its own cookies to complete and protect sign-in. Google uses its own cookies when you choose Google sign-in.

TBKit and tbkit.com use no analytics, advertising or tracking cookies, pixels or third-party scripts. The public website sets no cookies at all. Because the app’s cookies are needed to sign in, blocking them prevents signing in. We do not respond to a “do not track” signal because we do not track you across sites.

6. Service providers and sharing

We use these providers to run TBKit. Each processes information only as needed to provide its service to us. We will give account contacts at least 30 days’ notice before a new provider processes Customer Data, as our terms of service describe.

• Amazon Web Services hosts TBKit: the application, its database and backups, uploaded files, report caching, logs, sign-in through Amazon Cognito, and delivery of the website and sign-in page through Amazon CloudFront. Customer Data in the Service is stored in the AWS US East (Ohio) region. CloudFront delivers the website and sign-in page through AWS edge locations, which can be outside Ohio. Amazon Cognito sends account emails, such as temporary passwords and verification codes, for TBKit sign-ins. Amazon SES is set up for future TBKit email. TBKit does not send email through it yet: the only messages sent are WITTCO’s setup tests to Amazon’s test mailbox simulator and WITTCO’s own addresses.
• Google provides optional Google sign-in. Google Workspace hosts WITTCO’s business email, including support email. Customer Data you send to support by email is held in that mailbox, in Google’s locations.
• Cloudflare provides DNS for tbkit.com. It answers domain name lookups. Traffic to TBKit and the website does not pass through Cloudflare.
• Anthropic and OpenAI provide the AI assistants (Claude and Codex) that WITTCO staff use to build and support TBKit. Those tools can process organization names, staff names, email addresses and sign-in identifiers when we set up or support an account. They are not a feature of TBKit. We do not use them to read journal entries, bank transactions or other records in customers’ books, and we do not allow them to train models on Customer Data. They process that limited account information in their own locations under their own terms. We will give the notice above before any AI provider processes records in customers’ books.

We are testing a payment provider, NMI, using its test environment and test data only. No customer information or payments go to NMI.

Authorized WITTCO personnel access information only as needed to operate, secure and support TBKit. We may disclose information when the law requires it, or when reasonably necessary to investigate misuse, protect the security of TBKit, or protect someone’s rights or safety, limited to what the circumstances require. If the law requires us to disclose Customer Data, we tell the customer first when we are allowed to. If WITTCO is involved in a merger, acquisition or sale of its business, information may transfer to the successor, which must continue to protect it under this policy. We do not share personal information with advertising networks or data brokers.

Providers also have their own privacy notices: AWS, Google, Cloudflare, Anthropic and OpenAI.

7. Artificial intelligence

TBKit’s features do not use artificial intelligence to process customers’ books or account information. Before any product feature does, we will update this policy and email account contacts at least 30 days in advance, unless the change is required sooner to address a security risk. Section 6 describes the AI assistants WITTCO uses to build and support TBKit, and the limit on what they are allowed to see.

8. How long we keep information

• Books and records: while the organization is in TBKit. When an account ends, we follow the export and deletion steps in our terms of service. Deletion from the live service is performed by WITTCO. There is not yet a self-serve delete button. On request, we confirm a completed deletion in writing.
• Automated database backups: no more than 35 days, so information deleted from TBKit remains in backups only until those backups expire.
• Manual database snapshots taken before maintenance: deleted within 90 days after they are taken, unless the law or an open security investigation requires longer. We do not use a snapshot to revive an ended account except as the terms describe for a service recovery, and then we delete that data again.
• Uploaded bank files: the original file is deleted when the import is accepted, or shortly after its 24-hour review period expires.
• Web sign-in sessions: 30 minutes without activity, or 8 hours at most. Expired session records are deleted automatically within minutes. The access token lasts 15 minutes. The renewal token stored with the session expires within 7 days. Signing out deletes the session and asks Amazon Cognito to revoke the token; if that request does not succeed, the token can remain usable until it expires.
• Windows app sign-in: the refresh token on the PC lasts up to 30 days. Sign-out removes it from the PC and asks Amazon Cognito to revoke it; if that request does not succeed, it expires on its own. Uninstalling removes it from the PC and does not contact Cognito. Access and ID tokens are kept in memory for that session only.
• Cached report downloads: 5 minutes. Reports themselves are kept with the books.
• Sign-in profiles and access records: kept until we delete them. When someone leaves, we remove their access and turn off their sign-in, keeping the link to their sign-in so access can be restored if they return. We delete a person’s sign-in profiles and access records on request, and when the customer’s account ends, on the timetable in the terms. A profile created by a Google sign-in that was never given access is deleted on request.
• Application, administrative and database logs: at least 90 days. The configured period is 90 days.
• Load balancer access logs: at least 365 days. The configured period is 365 days. These logs can contain the requested address, including search text and one-time sign-in codes.
• Support email: as long as needed to handle the request and keep ordinary business records of the conversation.

We may keep information longer when the law requires it, or while needed to investigate a security incident or resolve a dispute. We will not shorten a retention period below the number stated here without the notice in section 12. A longer operational period does not reduce the deletion commitment for books in the live service.

9. Security

We protect information with measures that include:

• HTTPS with TLS 1.2 or later for connections to TBKit and to tbkit.com, with plain HTTP requests redirected to HTTPS, and encrypted, certificate-verified connections between our application and its database and cache;
• encryption at rest for our database, its backups and our log storage;
• a database and cache in private networks with no public access;
• access checks on every request against the user’s current permissions for that organization, with database row-level security as a second safeguard between organizations;
• access to books only for sign-ins we have explicitly approved; an authenticator code as well as a password for TBKit sign-ins; 2-Step Verification for firm staff who use Google Workspace, enforced by that firm’s administrator; and sessions that expire;
• production access limited to authorized WITTCO personnel and tools using individually assigned identities; and
• automated database backups kept for up to 35 days, and alarms for service problems.

These measures are not a certification. WITTCO does not hold a SOC 2 report or a PCI DSS attestation for TBKit, and this policy does not claim one.

No method of storage or transmission is completely secure. If we confirm unauthorized access to, or loss or alteration of, personal information we hold, we will notify affected customers without undue delay, and no later than 72 hours after we confirm it, and as the law requires. We will not delay confirmation to put off the notice. Please report suspected security issues to harry@getwittco.com without including passwords or other secrets.

10. Your choices and requests

If you use TBKit through a bookkeeping firm or business, ask that firm or business about your access. It asks us to add, change or remove access, and we remove access within one business day after an account contact asks. To ask about, correct or delete your own account information, email harry@getwittco.com. We may need to confirm your identity before acting, and we will explain if we must keep something for a legal or security reason. For information in a business’s books, we will refer your request to that business and help it respond.

You can review or remove TBKit’s Google connection in your Google Account connections. Removing it withdraws the permission you gave TBKit’s Google sign-in. Google asks again the next time you choose it. Removing the connection does not delete information WITTCO already holds or end an existing session immediately. Sign out of TBKit to end the web session, and sign out of the Windows app to remove its saved sign-in.

Depending on where you live, you may have additional rights under privacy law, such as rights to know, correct or delete personal information, or to appeal a refusal. We will respond to such requests as the applicable law requires. We will not discriminate against you for making one. We do not sell personal information, so we do not offer a “do not sell” mechanism. To exercise a right, email the address below. We will not require you to create an account solely to make a privacy request.

11. Children

TBKit is a service for businesses and their adult staff. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13 for our own purposes. Customers should not put information about a child into TBKit except where a lawful business record requires it. If you believe we have account information from a child under 13, email us and we will delete it.

12. Changes and contact

We will update this policy as TBKit changes and show the new effective date above. We will keep the previous version available on request. For a material change, we will email account contacts at least 30 days before it takes effect, unless the change is required by law or to address a security risk sooner. Before using personal information, including information from Google sign-in, for a materially different purpose, we will explain the change and obtain any consent that Google’s policies or applicable law require.

For privacy questions or requests, contact WITTCO LLC, Lacombe, Louisiana 70445, at harry@getwittco.com or (985) 370-9488.