Legal

Security and Trust

Effective Date: October 15, 2026 · Last Updated: October 15, 2026

Fynbase helps businesses manage financial and operational workflows. Protecting the information entrusted to the Services is part of that responsibility. This page describes our security and data-governance commitments and explains how to obtain more information.

Protecting customer information

We commit to reasonable administrative, technical, and organizational safeguards appropriate to the sensitivity of customer information and the risks of processing. Our Data Processing Addendum sets out the contractual safeguards for personal data processed on a customer's behalf.

Our security requirements include encryption in transit over public networks and at rest in production storage and backups; access limited to authorized people with a business need; MFA for privileged and remote administrative access; and logical separation of customer data. Personnel with access must be subject to confidentiality obligations.

Our operating policies require review of production changes, vulnerability remediation based on risk, security logging, supplier review, incident response, and periodic backup-restoration testing. Security is an ongoing process, and no online service can guarantee complete protection against every threat.

Customer ownership and AI

Customers retain their ownership rights in Customer Data. Fynbase processes that data to provide requested services, support authorized workflows, and meet the purposes and restrictions in its agreements.

Fynbase will not use customer confidential information or business, financial, or operational data to train generalized AI models for unrelated customers or third parties without express customer consent. AI providers processing that data on our behalf must observe the same restriction.

Using an AI feature is not training consent. AI features may process relevant data to extract information, summarize documents, recommend actions, or perform authorized tasks. Customers should review material outputs and configure appropriate approval controls because AI outputs can contain errors.

Access and shared responsibilities

Fynbase's security commitments cover the systems and processing within our responsibility. Customers control their authorized users, organizational permissions, connected accounts, and workflow instructions. Customers should promptly remove departing users, protect their devices and credentials, review integration permissions, and use available authentication and approval controls appropriate to their risks.

Never send passwords, recovery codes, full payment-card numbers, or unnecessary financial documents in an ordinary support email. If sensitive evidence is needed, contact us to arrange an appropriate exchange method.

Providers and processing locations

We require providers handling customer personal data on our behalf to accept appropriate confidentiality, security, and processing obligations. Our DPA describes subprocessor disclosures, advance notice of changes, and customer objection rights. Contact support@info.fynbase.co for the named subprocessor schedule applicable to your service and information about processing locations.

Where an international transfer requires additional legal safeguards, those safeguards must be established before the transfer. A supplier's certification or infrastructure controls do not by themselves establish a certification of Fynbase.

Data export and deletion

Customers have 30 calendar days after expiration or the effective date of cancellation or termination to request or complete an available data export. Contact support@info.fynbase.co for assistance, including when account access has ended.

Unless earlier lawful deletion is requested, customer content is deleted or irreversibly de-identified from active systems within 30 days after that export window, with residual backups expiring within 90 days after active-system deletion. Timely export requests and legally required retention are handled under the Privacy Policy and DPA, and retained data remains protected.

Incidents and security reports

Report suspected unauthorized access, a vulnerability, or a data-security concern to support@info.fynbase.co with the subject Security Report. Include a description, affected feature, approximate time, and safe reproduction details. Avoid accessing another customer's data, disrupting service, or sending sensitive records unnecessarily. Contact us before testing that could affect other users or production availability.

Our incident-response policy requires prompt internal escalation, containment, investigation, and remediation. Where a personal data breach affects information processed on a customer's behalf, we will notify the customer without undue delay after becoming aware of it and provide further information as it becomes available, consistent with the DPA and applicable law.

Assurance and additional information

This page is not a SOC 2 report, ISO certification, PCI attestation, or guarantee of regulatory compliance. Any Fynbase assurance claim must be supported by a current report or other appropriate evidence identifying its scope and period. Contact us to discuss available security documentation or specific requirements. Contractual commitments are governed by the applicable Agreement and DPA; no uptime or recovery-time guarantee is created by this page.

Fynbase | 1601 McCarthy Blvd, Suite R-5, Milpitas, CA 95035, United States | support@info.fynbase.co

Guide

Fynbase Security and Data Handling: What Small Businesses Should Know

Reviewed October 18, 2026

Client agreements, invoices, payment records, and employee expenses may contain confidential business details or personal information.

When evaluating a new platform, small businesses should understand how their information is protected, who can access it, and what happens to their records if they stop using the service.

Fynbase publishes security and data-handling commitments intended to help businesses evaluate these questions.

How Fynbase approaches data security

Fynbase's published Security and Trust information describes safeguards for protecting customer information.

These include encryption requirements for data transmitted over public networks and stored in production systems, as well as controls limiting access according to business needs.

The documentation also describes logical separation of customer data and multifactor authentication for privileged and remote administrative access.

Fynbase's published operating policies address areas such as vulnerability management, system changes, logging, incident response, suppliers, and backup-restoration testing.

These are published security commitments. They should not be confused with an independent security audit or certification.

Businesses with specific assurance requirements should request the relevant current evidence.

Who can access business information?

Small businesses often have several people working with financial records.

A founder may need an overview of invoices and expenses, while operations staff manage documents and billing activities.

When evaluating any financial platform, businesses should understand how access is granted, reviewed, and removed.

Important questions include:

Who can view financial documents?
Who can create or modify invoices?
Which users can approve expenses?
How is access removed when an employee leaves?
What administrative controls are available for the account?

The exact user-facing permissions and authentication options should be evaluated against the business's requirements.

A published commitment to administrative security does not automatically establish every customer-facing permission feature.

How does Fynbase handle data used by AI?

AI-powered features may need to process information from business records to complete a requested task.

For example, an assistant preparing an invoice follow-up may need the invoice amount, outstanding balance, and relevant client context.

Fynbase's published privacy and data-processing documents distinguish this task processing from using customer information to train generalized AI models.

The published commitment restricts training generalized models on customer confidential or business data for unrelated customers or third parties without express consent.

This does not mean that no external service provider processes data when an AI feature is used.

Businesses should review the applicable privacy terms and request information about subprocessors and processing locations when relevant.

What happens if a business stops using Fynbase?

Data portability matters when adopting financial software.

A business may need historical invoices, signed agreements, expense records, and supporting documents for accounting or operational purposes.

Fynbase's published terms describe a 30-calendar-day period after termination or expiration to request or complete an available data export.

They also describe subsequent deletion or de-identification procedures for active systems and backup retention, subject to applicable exceptions.

The specific export formats and available records should be confirmed before adoption.

Businesses should maintain appropriate copies of financial records and understand their own legal and accounting retention obligations.

Does Fynbase have independent security certifications?

Security policies and independently audited certifications are different.

Fynbase's published Security and Trust page does not establish a SOC 2 report, ISO certification, or PCI attestation.

Organizations requiring specific certifications or independent assurance should request current evidence rather than assuming that the use of established infrastructure providers establishes certification for the application itself.

How to evaluate Fynbase securely

Before introducing live financial records, start with a representative workflow and review the relevant requirements.