Security

Built like your booksdepend on it.

Because they do. Money data deserves a little paranoia, so thruflow is strict by default: organizations walled off from each other, a code from your phone before money moves, two people on every decision, and a history nobody can rewrite.

Request access

Read the privacy policy

Organizations walled offRow-level security on every table
Two-step sign-inA code from your phone, and again before money moves
History you can verifyAppend-only SHA-256 hash chain
Stored in the United StatesEncrypted in transit and at rest

What protects the books

Strict by default.And it says what it did.

Organizations walled off

Row-level security on every table. Nothing is readable without signing in, and each organization sees only its own data, whatever the app asks for.

Credentials sealed

QuickBooks connects through Intuit's own sign-in, so thruflow never sees your password. The connection's tokens are encrypted with AES-256-GCM, kept on the server and never sent to a browser.

Two sets of eyes

Entering, approving, posting and paying are split between people by seven built-in rules, each written down as it's applied.

Nothing posts unasked

A person confirms every invoice and bill posted to QuickBooks, with the full preview in front of them. Autopilot takes only the routine steps an admin hands it, each one recorded.

No double posting

Each posting carries a unique request id, so a retry after a timeout can never create a duplicate.

Two-step verification

A password aloneopens nothing.

Everyone can add a code from an authenticator app on their phone to their sign-in. Then thruflow asks for a fresh code again right before anything that moves money or grants access. Admins decide how strict: each person's choice, a code for sensitive changes, or a code at every sign-in.

Changing a vendor's bank details
Where customers are sent to pay
Inviting people and changing roles
Connecting QuickBooks
One-time recovery codes for a lost phone
The database itself enforces it, not just the screens

thruflow · you@yourco.com

481 902

Someone with your password signs in on a new laptop

Asked for the code. No phone, so nothing opens.

You sign in and type the code

You change where Mill Fabrics is paid

You invite a new approver

Integrity

A historythat can't be rewritten.

Every action is appended to a SHA-256 hash chain in which each entry seals the one before it. The database refuses to change or delete an entry, and anyone with access can verify the whole chain end to end. Try it: change an amount and watch the chain break.

Each entry seals the one before it (SHA-256, computed here in your browser)

#1041Entered bill BILL-2026-1042$4,210.00
Maya Chen · Sep 12, 14:02 · hash …
#1042Approved BILL-2026-1042 (SOD-05 passed)$4,210.00
Jordan Lee · Sep 12, 16:40 · hash …
#1043Posted BILL-2026-1042 to QuickBooks$4,210.00
Jordan Lee · Sep 13, 09:15 · hash …
#1044Paid BILL-2026-1042 by ACH (SOD-06 passed)$4,210.00
Priya Nair · Sep 15, 11:03 · hash …

Chain intact: every entry matches what was sealed.

Separation of duties

Nobody approvestheir own work.

Whoever enters a bill can't approve it, whoever approves it can't pay it, and whoever can change where a vendor is paid can't approve their bills. A team of one or two can relax the rules, and every waiver is recorded.

Maya enters BILL-2026-1042 · $4,210.00

Maya tries to approve it

Jordan approves it

Jordan tries to pay it

Priya pays it by ACH

SOD-01

Maker ≠ checker

Whoever submits an order can't approve it

SOD-05

Bill maker ≠ checker

Whoever enters a bill can't approve it

SOD-06

Approver ≠ payer

Whoever approves a bill can't pay it

SOD-07

Vendor master ≠ approver

Whoever changes bank details can't approve bills

Your data

Yours,start to finish.

What happens to a document from the moment it reaches thruflow to the day you leave. The companies that host it for us are named in the privacy policy.

1 · Arrives
Encrypted on the way in
Over HTTPS, or by email to your own thruflow address. The raw email is deleted after 30 days; what was read from it stays with the record.
2 · Stored
Walled off, in the United States
Encrypted at rest. Row-level security on every table keeps each organization's records to itself.
3 · Read
By thruflow's own reader
Claude reads a document only if you turn that on, and the terms it runs under don't let it train on your content.
4 · Used
By the people you invite
Each with the role you give them. With two-step on, a stolen password opens nothing.
5 · Leaves
When you do
Close your account and your organization's data is deleted within 30 days, except what the law makes us keep.