Security at ChaseList

Last updated: 16 October 2026

Your clients' bank statements and payroll reports are sensitive. Here is how we protect them.

• Encryption: TLS for all traffic. Files and database encrypted at rest (AES-256) by our hosting providers.
• Private by default: files are stored in private buckets and are never public. Downloads use links that expire within minutes.
• Secure upload links: each client link is a long random token. We store only a hash of it, links expire and rotate with every reminder, and search engines are told not to index them. Clients never need an account or password.
• Isolation: database row-level security ensures each bookkeeper sees only their own data.
• Access: only named Aurora staff can access production systems, with multi-factor authentication and least privilege. We don't look at your documents unless you ask us to for support.
• Retention you control: files are deleted automatically 90 days after a period closes (configurable). Everything is deleted after you close your account.
• Upload safety: file-type allow-list and size limits. Uploaded files are stored inert and never executed by ChaseList.
• Payments: handled by Stripe (PCI DSS Level 1). We never see full card numbers.
• Incidents: we notify affected customers without undue delay, within 48 hours of confirming an incident affecting their data.
• Vendors: Sub-processors under data processing agreements.
• For tax and financial professionals: our DPA includes the service-provider terms you need for your written information security program (FTC Safeguards Rule).
• Report a vulnerability: info@helloaurora.ai. We respond within 2 business days.