Privacy Policy

BreakZero ("we", "us") provides a financial reconciliation and close platform at platform.usebreakzero.com, with a marketing site at usebreakzero.com. This policy describes what we collect, how we use and protect it, and how to reach us. We do not sell personal information, and we do not use customer data for advertising.

Information we collect

• Account information. Name, email address, role, and a password hash (we never store passwords in plain text). If your organization uses single sign-on, we receive your identity from your identity provider.
• Financial data you connect. When your organization connects a data source — bank statements or feeds, ledger/ERP entries, payment processor records, or files you upload — we receive and store that data read-only, solely to provide the reconciliation and close service to your organization. We can never move money or write back to your systems.
• Usage and audit records. Sign-ins (including IP address), administrative actions, data imports, and reconciliation activity are recorded in an append-only audit log — this is a core feature of the product.
• Marketing site analytics. usebreakzero.com uses GoatCounter, a privacy-respecting, cookieless page counter. We do not run advertising trackers.

How we use information

To operate the service (reconcile records, surface exceptions, support the close), to secure it (authentication, audit, abuse prevention), to send transactional email (invitations, password resets), and to support you. Nothing else: no advertising, no resale, no training of models on your financial data.

Where data lives and how it's protected

• Hosted on Render (United States), with data encrypted in transit (TLS) and at rest.
• Connected-system credentials and tokens are additionally encrypted at the application layer before storage and are never displayed after entry.
• Every organization's data is isolated behind database-enforced row-level security — one tenant can never read another's records.
• Passwords are hashed with argon2id; sessions are revocable server-side; the audit log is append-only.

Service providers

We use a small set of providers to run the service: Render (application and database hosting), Cloudflare (marketing site and DNS), and Resend (transactional email delivery). Data from systems you connect (for example Intuit QuickBooks Online, Xero, Stripe, or your bank's statement delivery) is accessed under the authorization you grant in that system and used only as described above.

Data from connected accounting systems

Where we access data through a provider's API (such as Intuit or Xero), we do so with read-only intent, retrieve only the records needed for reconciliation, and store access tokens encrypted. Disconnecting a source, or asking us to remove it, deletes the stored tokens. Our use of information received from these APIs follows each provider's platform policies.

Retention and deletion

We keep your organization's data while the account is active. On request — or when an account closes — we delete the organization's data, including connected-system credentials; routine backups age out on a rolling basis afterwards. Email contact@usebreakzero.com to request deletion, a copy of your data, or a correction.

Changes and contact

If this policy changes materially we will note the new effective date here and notify account administrators. Questions: contact@usebreakzero.com.