Security Policy

Where your data lives

The Skrooge App and your data are stored on Amazon Web Services (AWS) in the United States. Your books are kept in Zoho Books. Our AI providers process requests in the United States, the European Union and, for Claude models on AWS Bedrock, in AWS regions worldwide. AWS keeps no copy after returning the result, and Anthropic, OpenAI and Mistral delete theirs within 30 days by default.

Encryption

All data is encrypted in transit (TLS 1.2 or higher). Your documents and our backups are encrypted at rest (AES-256). Skrooge never stores your password; sign-in is handled by AWS Cognito.

Who can see your data

• Your dedicated accountant and tax manager. Every team member has a personal account, with access limited to what their role needs. Access is removed when someone changes role or leaves.
• A small number of authorised engineers, only when needed to fix a technical issue. Each engineer signs in with a personal account, every connection to our production systems is logged, and every change to your data is recorded with who made it and when.
• No other clients. Each client’s data is kept separate from every other client’s.

Email connections

• Gmail connection: Skrooge asks only for permission to create a label, a filter and a forwarding rule, so it cannot read your inbox. Gmail forwards only the emails that match your filter, and you can switch this off at any time.
• Chrome extension (optional, for past emails): the extension needs permission to read and send emails in your Gmail. It uses it only to find the emails that match your filter and forward them to your Skrooge address. You can remove it at any time.
• Our Gmail integration has passed Google’s annual security assessment (CASA Tier 2), which checks that apps handle Gmail data securely and delete it on request.

AI

Our AI providers receive only the data needed for each task, and your data is never used to train AI models owned or offered by other companies. With your permission, we use it to improve Skrooge’s proprietary AI/ML systems, which run on our own infrastructure and are never shared with anyone else. An accountant reviews AI-assisted work before anything is filed or submitted on your behalf. Section 6 of our Privacy Policy has the details.

Monitoring, backups and incidents

Our systems are monitored around the clock with automated alerts. Your data is backed up automatically at least every 24 hours. If a security incident affects your data, we will notify you and the UAE Data Office as required by law.

Report a security issue