A factual view of the controls available in FastAccounts, the choices self-hosters own, and the review and planned work before production rollout.
Review required · assessed 9 October 2026FastAccounts can be self-hosted, in which case the operator chooses and secures the infrastructure. The hosted pilot runs the same Docker application with PostgreSQL and persistent evidence storage on FastSME-managed infrastructure. The underlying hosting provider is deployment-specific and must be named in a production customer agreement.
Integration credentials are encrypted at rest with a key-versioned Fernet vault and are excluded from browser responses and logs. Hosted traffic uses HTTPS/TLS. FastAccounts does not currently claim that every database field or uploaded evidence file is application-level encrypted at rest.
Self-hosters are responsible for their own database, evidence-storage, encryption and restore process. Planned: encrypted managed-hosting backups and tested restores. The repository does not record a completed backup-and-restore drill, so no recovery-time promise is made.
Available: local email/password accounts and Google sign-in, invite-only organisation membership, signed sessions, CSRF protection and owner, administrator, accountant, approver and viewer roles. Passwords use scrypt hashes; confirmation and reset tokens are single-use hashes, and repeated sign-in attempts are throttled. Business records are scoped by organisation and cross-tenant access is covered by tests. Planned: a managed-service MFA policy and edge rate limiting.
Send a suspected security incident privately to info@predictivelabs.ai with “FastAccounts security incident” in the subject. The team will preserve relevant records, investigate scope and coordinate customer communication. Planned: contractual incident-response times; none are currently offered.
Report an incidentPython dependencies are declared in requirements.txt and CI compiles the application, runs tests, verifies migrations and scans committed files for common secret patterns. The project does not claim continuous automated dependency-vulnerability monitoring. Report a suspected vulnerable dependency through the private security contact.
Please report vulnerabilities privately before public discussion and include affected versions, reproduction steps and impact. We will confirm a communication channel, investigate in good faith and coordinate a disclosure date with the reporter. Please allow a reasonable opportunity to remediate; response or fix deadlines are not yet guaranteed.
Make a private disclosure