EBITnow reads from your bookkeeping, billing, and payroll systems over scoped OAuth connections, computes a continuously refreshed EBITDA view, and writes nothing back. Below is the plain-language record of how customer financial data is handled — written for a CFO and a security reviewer to read together without translation.
What is read from source systems
EBITnow pulls a defined set of objects — chart of accounts, posted journal entries, invoices, subscriptions, payroll runs — over read-only OAuth scopes. We pull the minimum fields needed to compute EBITDA on a cash basis: revenue, deferred revenue movement, COGS, and the relevant operating expense categories.
EBITnow does not read unstructured fields, customer PII, employee compensation records, or banking credentials. The platform is not a general ledger — it is a purpose-built EBITDA engine, and the read scope is constrained accordingly.
What is stored, and where
Computed values are stored in our production Postgres cluster encrypted at rest with AES-256. Customer-specific secrets are held in a dedicated KMS with per-environment key rotation. By default, US-East (Virginia); EU-West (Ireland) regional residency is available on the Enterprise plan.
Source credentials are never stored in plaintext, never logged in application logs, and are scoped to read-only at the integration layer — there is no write path into your source systems.
Retention and deletion
Computed EBITDA history is retained for the life of the customer contract plus 30 days. On contract end, all customer data is hard-deleted from primary storage within 30 days and from backups within 90 days. A deletion certificate is issued on request.
A documented sub-processor list is published on the security portal and updated within 10 business days of any change. Notification is sent to all customers on file.
Who can access your data
Access is least-privilege, MFA-enforced, and logged. Production access requires a hardware-backed key and a documented change ticket. Fewer than 12 named EBITnow engineers have any path to customer data, and access is reviewed quarterly.
EBITnow does not provide tax, audit, or advisory opinions. Computed figures are presented on a cash basis and are intended as an internal management view — they are not a substitute for audited financial statements or formal tax advice.
