Your ledger stays in your own file. Here is exactly what Infraxus can see, and what it cannot.
In plain language, for an owner about to grant access to their accounting file. The short version: the work happens inside the QuickBooks Online or Xero subscription you already own, through a user invitation you grant and can remove in one click, and Infraxus never asks for a banking password.
Infraxus is a user in your file, not the owner of it.
Bookkeeping runs inside the accounting file you already own, in QuickBooks Online or in Xero. Infraxus is granted access from inside that file, as a user you invite and can remove. Nothing is copied into a ledger of ours, because there is no ledger of ours.
Who has access.
One person. Infraxus is founder operated, so the user you invite is Liam Collier and nobody else. There is no team, no offshore queue and no account manager with a login to your file. The QuickBooks Online and Xero logins that hold your invite are Liam's alone, behind multi factor authentication, and nobody else holds them.
How access is granted.
You invite liam@infraxus.com from inside your own file. In QuickBooks Online that is Settings, then Manage users, then Accounting firms. In Xero it is Settings, then Users, then Invite a user, as an Administrator. You choose the role, and you can see the access in your file at any time. The steps, screen by screen.
Online banking.
Infraxus never asks for your online banking password and never holds one. Bank feeds reach your accounting file through the connections that file already has with your bank. If you are ever sent a message that appears to come from Infraxus asking for banking credentials, it did not come from us: tell us at security@infraxus.com.
Removing access.
Remove Infraxus from your users at any time, without telling us first. In QuickBooks Online: Settings, Manage users, then remove the accounting firm. In Xero: Settings, Users, then delete the user. The ledger and its history stay in your file. Our access is removed within 30 days of the work ending in any case.
If Infraxus disappeared tomorrow.
You would lose nothing. The file, every transaction, every reconciliation and every monthly note is yours, in your own subscription, under your own login. You stay the primary admin throughout. That is the point of working in your file rather than ours. If Liam is away for a week, the file is a week behind and nothing else, because the work is weekly and nothing of yours sits anywhere but your file; and you can cancel by email at any time.
What Infraxus holds about you.
Your name, the phone number or email you gave us, your business name, which platform your books are on, your revenue band, the ad click and page details that show which search brought you here, a record of how the website was used, the billing record held by Stripe, the texts and calls you exchange with Liam, the details you give Calendly when you book, and any statement or receipt you send Liam for the work. That is the whole list. Card details are entered on Stripe's own pages and never touch our website or our systems. The privacy policy has the detail.
Locked down the same way.
Infraxus is founder operated, so multi factor authentication is enforced on every account that touches client data: hosting, database, email and the accounting platforms. Admin credentials sit in a password manager, devices are disk encrypted, and client working data lives in access controlled, multi factor gated cloud storage, never on a laptop or an office drive.
In transit and at rest.
Every connection to this website and to the services behind it terminates TLS 1.2 or higher, and every stored byte sits behind AES-256 at the providers below.
Independently attested.
This website runs on Vercel and its lead records on Supabase, each SOC 2 Type II attested. The attestation applies to those providers; Infraxus does not hold its own, and does not claim one.
Reported within 24 hours.
If a security incident affecting your data is confirmed, you are told within 24 hours what happened, what was affected and what was done about it, in line with the breach notification law that applies where you are.
The services that hold information on our behalf.
Each is bound by its own data processing terms. Your accounting file is not on this list because it is not ours: it sits in your own QuickBooks Online or Xero subscription.
| Service | What it holds | Where |
|---|---|---|
| Vercel | Hosts this website and the form endpoint, and keeps the ordinary request logs a host keeps for security and performance. | United States |
| Supabase | The record of your inquiry: what you gave us on a form, when, and which page and search brought you here. | Supabase's Asia Pacific region; the exact region in writing on request |
| Dropbox | The working files the founder keeps for the bookkeeping (a statement you send, a note in progress), in access controlled, multi factor gated storage on the founder's account. | United States |
| Resend | Transactional email: the alert to Liam when you leave your details, and the emails Infraxus sends you. | United States |
| Calendly | The name, email and time you give when you book a call. | United States |
| Stripe | Your subscription and billing record, and any card you later add, on Stripe's own pages. | United States |
| PostHog | Website analytics, with every form input masked at capture. | United States |
| Advertising measurement: whether a visit from a Google ad led to a call, a text or a form. | United States | |
| Phone carriers | The delivery of calls and text messages to and from (646) 567-2713. | United States |
Ask before you invite anyone into your file.
A written answer comes from Liam himself. Security questions go to security@infraxus.com; anything else, text or call (646) 567-2713.
- The current sub processor list in writing
- The provider SOC 2 attestation links
- A mutual NDA before any file is opened
- Liam confirms in writing when access is removed