AccountFUN

Security & your data

Your books.
Under your control.

Information security management, controlled access and data ownership are part of the platform.

Veritas certification badge for ISO/IEC 27001

ISO 27001 Certified

Certified to ISO/IEC 27001:2022, the international standard for information security management. Its risk-based framework helps us identify information security risks, choose appropriate controls, and review them as our services and risks change.

Certificate No: 258VMSX080104

Security controls

Protection at each step.

Signing in

Use an authenticator app or passkey as your second factor. Administrators can set an automatic idle lock for their organisation.

Who sees what

Choose ready-made or custom roles, including view-only access. Permissions and audit history help your team work with clear boundaries.

Encryption

HTTPS protects data in transit. Encrypted storage protects the database and files; selected sensitive fields receive additional application encryption.

Ownership & continuity

Your data stays yours.

Export your books and retained files. Every plan has platform backup protection. Standard adds daily self-service recovery and Plus adds finer-grained saved points, within up to 30 days of available history.

Security and vulnerability disclosure

Last updated: October 16, 2026

AccountFUN is operated by XOMG Limited, 50 Bonham Strand, Sheung Wan, Hong Kong. If you think you have found a security vulnerability in AccountFUN, please tell us. This page explains how to report it and what you can expect from us.

1. How to report

Email . Please include:

  • a description of the vulnerability and the type of issue;
  • the affected URL, page, API endpoint or component;
  • step-by-step instructions to reproduce it, with any proof-of-concept requests, scripts or screenshots;
  • the impact as you understand it, and what an attacker could do with it;
  • how we can contact you for follow-up questions.

Keep personal data out of your report unless it is needed to show the issue. Please write in English. Our contact details are also published in machine-readable form at /.well-known/security.txt.

2. What we commit to

When you report a vulnerability under this policy, XOMG Limited will:

  • acknowledge your report within 3 business days;
  • keep you informed as we investigate and fix the issue, and tell you when it is resolved;
  • not take legal action against you for good-faith security research that follows the rules on this page.

If you are unsure whether something you plan to do is allowed, ask us first at the address above.

3. Rules for testing

To stay within this policy, you must:

  • not access, change or keep data beyond what is necessary to show the vulnerability. If you reach data that is not yours, stop, tell us, and delete any copies;
  • not violate anyone's privacy, including our customers' and their contacts';
  • not destroy or corrupt data, and not run denial-of-service, load or resource-exhaustion tests;
  • not use social engineering, phishing or physical attacks against our staff, customers, offices or suppliers;
  • test only with accounts and organisations you created yourself;
  • give us reasonable time to fix the issue before you disclose it to anyone else.

4. Scope

In scope:

  • app.accountfun.com (the AccountFUN app and its API);
  • www.accountfun.com (this website and the documentation under /docs).

Out of scope: third-party services we use or link to, such as payment, bank-feed, email and hosting providers. Please report issues in those services to the provider. If a third-party issue affects AccountFUN specifically, you can tell us too.

5. No bug bounty

We do not run a bug bounty programme and do not pay for vulnerability reports.

6. How we protect data

A short summary of our current practices:

  • Encryption in transit: the app and this website are served over HTTPS (TLS), and plain HTTP requests are redirected to HTTPS.
  • Encryption at rest: the production database and files are stored on encrypted storage, and selected sensitive fields, such as bank-connection tokens, are also encrypted by the application.
  • Tenant isolation: each organisation's records are kept separate by row-level security in the database and by permission checks in the app.
  • Multi-factor authentication: users can turn on sign-in with an authenticator app or passkey.
  • Backups: every plan receives platform backup protection. Standard offers daily self-service recovery points and Plus offers finer-grained points. Available history is shown in the app.

No system is free of risk, which is why we welcome reports. For privacy questions, see our Privacy Policy.