Security

Nummbas takes the security of your financial data seriously. Here is how we protect your information.

Data Encryption

• All data is encrypted in transit and at rest
• Connections to third-party platforms use secure protocols

Authentication

• OAuth connections - most integrations use OAuth, which means Nummbas never sees or stores your platform passwords. You authorize access directly through each platform.
• API keys - for integrations that use API keys (Stripe, ShipStation, Recharge), keys are stored securely and encrypted at rest. We recommend using restricted or read-only keys.
• Two-factor authentication - enabled by default for all accounts using email verification codes. Users can switch to an authenticator app (such as Google Authenticator or Authy) in Settings for stronger security. Backup codes are provided when MFA is set up.

Access Control

• Role-based access - team members have different levels of access based on their role. Owners control billing and account deletion. Admins manage integrations, team, and settings. Members use the dashboard and, in Product Command Center, receive deliveries, count stock and record adjustments. See Team Members for the full permissions table.
• Password confirmation - actions like rebuilding data, deleting accounts, and transferring ownership require password re-entry
• Session management - secure sign-in sessions with automatic expiration

Data Sharing

• Nummbas does not sell your data
• Nummbas shares data with service providers only when needed to provide the service you choose. See the Privacy Policy for details
• The Data Sharing feature creates time-limited, optionally password-protected links that you control
• Share links can be revoked at any time
• Recipients get read-only access only

Integration Security

• Nummbas reads your platforms. It writes to them only when you turn on a feature that needs it or approve a change. For example:
  • With stock updates allowed for a store, or stock levels sent to eBay, Nummbas changes stock quantities and product costs there after your deliveries, counts and adjustments.
  • If you keep QuickBooks or Xero with Nummbas Books, Nummbas sends a summary of each payout to it once you turn sending on. If you take invoice payments online, Nummbas starts each checkout in your own Stripe or Square account.
  • With conversion sending on, Nummbas sends your orders to your ad platforms. Nummbas also applies ad account changes you approve, such as pausing a campaign or changing a budget.
• Plaid handles secure bank sign-in, and Nummbas does not receive your bank password
• Platform access can be revoked at any time by disconnecting the integration
• Each integration can be disconnected or rebuilt on its own

Data Retention

• Your data is retained as long as your account is active
• If you delete your account, the organization is closed and data is retained for 90 days. Contact support during that period to request restoration. After 90 days, the data is permanently removed
• Owners and admins can rebuild synced data from Settings > Data and account removal > Refresh data when needed

Questions