Isolation is enforced by the database
Every company's data is separated at the database layer using row-level security: the database itself refuses to return one company's rows to another, regardless of what the application code asks for. Every isolated table carries a test proving one company cannot read, write, or move another company's data, and those tests run on every code change before it ships.
Credentials are encrypted and never shared
RunHank connects to QuickBooks and the field software through each vendor's official authorization flow, so it never sees or stores a QuickBooks password. The access tokens those flows issue are encrypted at rest, per company. There is no shared platform credential and no platform merchant account: payments run entirely on the company's own merchant relationship, and RunHank never touches card data.
Nothing moves money on its own
A person approves anything that changes an invoice, contacts a customer, or records a payment. The automated step that creates and emails an approved invoice checks the amount against what was approved and refuses to send if the two no longer match. The field software is never written to at all.
Everything is on the record
Every action in RunHank, taken by a person or by the system, lands in an append-only audit log with who, what, and when. Nothing is edited or deleted out of that record.
The data belongs to the shop
The software is licensed; the data and configuration belong to the company, exportable at any time. If an engagement ends, the company receives a full export and the data is deleted on a stated timeline.
Reporting a concern
Security reports are read first. Use the contact form and mention security in the message.