Close
Security at Hyrlo
How Hyrlo protects your books: who can sign in, what they can see, the record of what changed, and where your data lives. Only what’s built and switched on is here.
Signing in
Two-factor sign-in
With an authenticator app, and ten single-use recovery codes in case the phone is lost. An admin can require it for everyone in the workspace.
In Hyrlo: Settings, then Security
Single sign-on
SAML or OIDC on the Business plan, for a domain you’ve verified, run through WorkOS (listed in the sub-processors). The workspace owner sets it up, and can make it the only way in.
In Hyrlo: Settings, then Security
Passwords
At least eight characters, and stored only as a one-way hash. An email address is verified before its first sign-in.
Repeated attempts
Sign-ins, password resets and sign-ups are rate limited, and after repeated failures an account is locked for longer each time.
Who’s signed in, and what they can see
Signed-in devices
Every device you’re signed in on, with a sign-out for each and one for all the others. A session ends after 30 days, or after 7 days unused.
In Hyrlo: Settings, then Security
Sign-in history
Ninety days of sign-ins, failed ones included, with the device, browser, network address and, where it’s known, the place. Admins see the whole workspace’s.
In Hyrlo: Settings, then Security, then Sign-ins
Roles
Owner, Admin, Submitter and Viewer, with approval groups on top. A Viewer reads and exports, and can’t change anything.
In Hyrlo: People
A record of what changed
The audit log
Who changed what, and when. Admins and Owners can read it and export it as CSV or JSON.
In Hyrlo: Settings, then Audit
Posted entries stay posted
A posted journal can’t be edited or deleted; the database refuses it. A mistake is corrected by reversing it with a new entry.
Kept for six years
The audit history is kept for at least six years while your workspace is open. It isn’t a setting anyone can shorten.
Your data
Hosted by us, in the UK
Hyrlo’s application servers, database and file storage run on Vexon Group Ltd’s own infrastructure in the UK. Five third parties process data for us — for email, network delivery, reading uploaded documents, billing and single sign-on — and each is listed with what it sees and where.
See the sub-processorsEncrypted in transit, and where it matters most at rest
Every connection is HTTPS only. People’s bank details, and the keys Hyrlo holds for connected services such as Stripe, are encrypted again in the database.
Yours to take away
Reports and the ledger export as CSV, Excel or PDF, the year-end pack as a PDF with its spreadsheets, and the audit log as CSV or JSON. Closing a workspace offers its records as one file too.
When you leave
A closed workspace is kept for 30 days, and can be recovered until then. After that it’s deleted, ledger, files and audit log included.
The agreements
The data processing agreement and the sub-processor register are public, with every version kept.
Reporting a security problem
Email security@hyrlo.com with what you found and how to see it. It reaches the people who run Hyrlo’s support, and we reply within one working day.
security@hyrlo.com Every way to reach usQuestions
Where is my data stored?
On Hyrlo’s own infrastructure in the UK: the application servers, the database and file storage. The third parties that process data for Hyrlo, and what each one sees, are listed on the sub-processors page.
Can I make my team use two-factor sign-in?
Yes. An admin or owner who has two-factor on can require it for everyone in the workspace. On the Business plan, the owner can require single sign-on instead.
Who can see the audit log?
The workspace’s Admins and Owners. They can export it as CSV or JSON at any time.
What happens to my data if I close my workspace?
It’s kept for 30 days, and you can recover the workspace until then. After that everything in it is deleted.
How do I report a vulnerability?
Email security@hyrlo.com. We reply within one working day.
Try every module for 14 days
No card needed to start. Choose a plan when the trial ends.