Loading…
Loading…
Security
Mugavi sits between your books and your customers. That means we see customer names, balances, payment behavior, and the dunning messages you send. Here's exactly what we do (and don't do) with that access.
All traffic is TLS 1.2+ (HSTS enabled). Our managed Postgres provider runs the database backups.
Sign-in runs through Clerk. Your team members only see the organizations they belong to, and database queries are scoped by org_id at the application layer.
Mugavi runs on Vercel (compute) and managed Postgres (data). Secrets live in Vercel environment variables, not in the code or the client bundle.
Connecting QuickBooks starts with a single-use, time-limited sign-in check tied to your session, so nobody can attach their books to your organization. Disconnect, from the Integrations page, asks Intuit to revoke our access and deletes the stored tokens.
Key actions, such as reminders sent and integrations connected, are recorded in an events log scoped to your organization, and you can read it on the Activity page in your dashboard.
What we don't do
Controls
Honest status as of today. "Not yet" means we do not have it and have not started an audit.
| Control | Status |
|---|---|
| TLS 1.2+ everywhere | enforced |
| Database backups (managed Postgres provider) | enforced |
| Secrets in environment variables only | enforced |
| Queries scoped by organization in the application | enforced |
| Sign in with Google or email (via Clerk) | available |
| SOC 2 report: we do not have one | not yet |
| GDPR + UK GDPR + CCPA-aligned DPA | available |
| DPA on request | available |
Incident response
We commit to notifying affected customers within 72 hours of becoming aware of a security incident that materially impacts their data, consistent with our DPA. You can reach the security team directly at security@getcollectly.app for disclosure, responsible-vulnerability reports.
Bug bounty: we don't have a paid program yet, but we acknowledge every responsible report within one business day and ship a fix on a negotiated timeline.
Compliance
Mugavi serves small businesses and bookkeeping practices in the United States and the United Kingdom. Accounts are processed in a single region (US). We act as the data processor for your customer data; you remain the data controller. Our Data Processing Agreement is available below.