Your data is our top priority

What we store

Your account details, your contacts, the invoices, quotes, expenses and bills you create, and the transactions extracted from bank statements you upload. We store the extracted transactions, not the statement file: the PDF or CSV is parsed and discarded. We never ask for your online-banking login, and no feature of ereQa connects to your bank account.

Where it lives

The database is hosted by Supabase, the API by Railway and the website by Vercel. Each publishes its own SOC 2 Type II report, and we rely on those audits rather than claiming one of our own. Data is encrypted at rest by the database provider and in transit with TLS. We do not operate servers of our own.

Payments

ereQa never handles invoice money. Your clients pay your own account directly, using the payment details you add in Settings; you mark the invoice paid. Your ereQa subscription is billed through Bani and Paystack, whose payment pages take the card or bank details — we receive only the confirmation. There is no card number anywhere in our database to lose.

Who can see your data

You, anyone you invite to your workspace, and an accountant you explicitly grant access to — which you can revoke at any time from Settings. Our own staff can access account data only to resolve a support request you have raised, and that access is logged. Clients who receive an invoice link see that invoice and nothing else.

Accounts and sessions

Passwords are hashed with bcrypt and are never stored or sent in plain text. Sessions are short-lived tokens that expire and must be renewed; signing out invalidates them. Sign-ups and password resets are confirmed by email, and the public forms are protected against automated abuse.

Backups and exports

The database provider takes automated backups. Independently of that, your data is yours: every plan can export invoices, expenses and contacts as CSV at any time, and closing your account deletes the data we hold on you, subject to the records the law requires us to keep.

What we ask of you

Use a password you do not use elsewhere. Review who has access to your workspace when someone leaves. Treat an email asking for your ereQa password as fraud, because we will never send one.