Security
Built so nobody has to take anyone's word for it.
A building's books are only worth something if nobody can quietly change them. These are the rules Commonkeep enforces in its database, not just on the screen.
How the books stay honest
Two different people sign every expense
The treasurer signs first, then the committee head. The system refuses a signature from whoever spent the money; the designated backup signs instead. There is no setting to turn this off.
Posted entries can never be edited or deleted
The ledger is append-only, enforced by database rules that reject any change to a posted entry. A mistake is corrected with a new, visible reversing entry, so the history always shows what happened.
Every action leaves a trail
Every change records who did it, what changed and when. Roles have start and end dates, and permissions are checked against the role a person held on the day they acted.
Each building is walled off
Every read and write is scoped to one society or block. Automated tests check that a member of one building can't open, list or change another building's records. We also attack one building's data from another's admin account on every release: reads, writes, exports and lists all fail safely.
People decide
Nothing writes to the books on its own: the spender confirms every field and two people sign. Duplicate and unusual-amount checks warn; they never block or reject.
No passwords to steal
Members log in with a one-time code sent to their phone. There are no owner passwords to reuse, forget or leak.
Your data
Your society owns its books. We run the software for it.
Our terms include a data processing agreement: we act only on your society's instructions and help it answer members' requests.
Every service provider that touches your data is on our sub-processor list, with what it does and where. We give 30 days' notice before adding one.
No analytics or advertising services in the app or on this website. This site loads nothing from third parties.
PDF statements, Excel and a full archive with every receipt, any time, on every plan.
Payments go straight to your society's or block's own bank account. We never see bank or card details.
Responsible disclosure
Found a security issue? Tell us.
Email [email protected] with the steps to reproduce it. We acknowledge within 3 working days and keep you posted until it's fixed.
Machine-readable contact: /.well-known/security.txt
Please
- Test only with accounts and a society you set up yourself.
- Stop and tell us as soon as you see anyone else's data. Don't keep or share it.
- Give us a reasonable time to fix it before you publish.
- No denial-of-service, load testing, spam, SMS pumping or social engineering of members or staff.
If you act in good faith within these rules, we won't pursue legal action against you for your research.