Built for records that
have to last
An accounting system holds the evidence behind a tax return. Below is what protects that evidence in RTS Book — described plainly, with the mechanism behind each claim rather than a badge.
Tenant isolation
Every company's data lives behind its own tenant boundary. Queries are scoped by tenant at the data layer, not by a filter someone might forget in a new screen.
Cross-tenant access is treated as a test failure, not a bug report — the isolation checks run on every build.
Audit log
Financial, administrative, security and export actions are recorded with who did what and when. Records are appended, never edited.
Passwords, tokens and secrets are never written to a log — sanitisation happens before anything reaches storage.
Locked tax periods
Once a tax period is closed, entries inside it cannot be altered. A correction is made the way an accountant would make one — with a new, dated document.
Financial records are never hard-deleted. Corrections use void, reversal, credit note or adjustment, so the history stays legible to an auditor.
Multi-factor authentication
Sensitive administrative actions require a fresh second factor at the moment they are performed, not merely at sign-in.
Roles are least-privilege by design: an Admin runs the company, while ending the subscription or changing the company's legal identity stays with the Owner.
Backups and rehearsed restores
The database is backed up automatically with point-in-time recovery. More importantly, we restore from those backups on a schedule and measure how long it takes.
The first full restore drill completed in about 15 minutes with row-count parity across every table. A backup nobody has restored is not a backup.
Encrypted at rest and in transit
Storage is encrypted with managed keys, traffic is HTTPS-only with strict transport security, and documents in the vault are private with time-limited access links.
Uploaded documents are never publicly addressable; every download is issued as a signed, expiring URL tied to the person requesting it.
Also in place
- Strict security headers and a per-request content security policy
- Rate limits on authentication and other sensitive endpoints
- Input validation at the boundary of every action
- Least-privilege roles with per-company membership
- Sanitised error reporting that never carries customer data
- Long-term retention aligned with UAE tax record-keeping obligations
Where your data is held
RTS Book is cloud-hosted, with UAE relocation planned. We make no residency claim about the current region, because it would not be true today — and a claim you cannot verify is worth nothing to you. Data is encrypted at rest and in transit wherever it sits, and retention follows UAE tax record-keeping obligations regardless of region.
Found a vulnerability?
Report it to us privately and we will respond. We would rather hear it from you than from a customer.
support@rtsbc.aeRTS Book prepares and organises your figures. It is designed for professional review before filing, and does not submit returns on your behalf.