Built for firms handling other people's financial data.
Fibby Ninja sits between your clients' QuickBooks data and your firm's AI assistant, so we designed it with the same instinct any accounting firm has: isolate client data, limit who can see what, and keep a record of who accessed it. Here's a concrete look at what that means today — not aspirational roadmap items, but what is actually running.
Encryption in transit
All traffic to the web app and the MCP API runs over HTTPS/TLS. We also send HTTP Strict Transport Security (HSTS) with a long max-age and includeSubDomains, so browsers refuse to fall back to plain HTTP.
Encryption at rest for connection credentials
QuickBooks OAuth access and refresh tokens are encrypted with AES-256-GCM (a random 12-byte IV per token, with authenticated encryption) before they're written to the database. Encryption keys are versioned, so they can be rotated without re-authenticating every connection.
Per-firm data isolation (Postgres RLS)
Every firm's data lives in the same database, but Postgres row-level security policies scope every query to the current user's own firm (resolved server-side from their active membership). Admin-only tables and actions are additionally gated by role checks enforced in the database itself, not just the application layer.
Granular, connection-level access
Access to a given connected company isn't all-or-nothing: firm admins grant individual team members read or read/write access per connection, and can review or revoke it at any time from Team & access.
Scoped AI access, not blanket access
When your firm connects Claude, ChatGPT, or another AI client via our MCP connector, that client authenticates as a specific user through OAuth 2.1 and a signed JWT. The MCP server resolves that token to the user's own firm and access grants on every call — it can only retrieve the companies that user is already authorized to see inside Fibby Ninja, nothing more.
Multi-factor authentication
Users can enroll a TOTP authenticator app (Google Authenticator, 1Password, etc.) as a second factor from Settings → Security, backed by Supabase Auth's MFA support.
Audit logging
Firm-level administrative actions (membership changes, access grants, connection changes) and MCP tool calls (which tool, which user, which connection, when) are recorded in an audit trail so admins can see how their firm's data has been accessed.
Rate limiting & abuse protection
The MCP API applies per-client rate limiting to sensitive endpoints to reduce the impact of credential stuffing or runaway clients, in addition to a strict Content-Security-Policy, X-Frame-Options, and related security headers on the web app.
Infrastructure
The application and database run on Supabase (Postgres, authentication, and file storage) and Railway (application hosting for the web app, MCP API, and background worker) — established providers we rely on for their own infrastructure security rather than operating our own data centers. See our Sub-processors page for the full list.
Reporting a security issue
If you believe you've found a security vulnerability in Fibby Ninja, please email security@fibby.ninja with details so we can investigate. We're a small team in active beta, so please allow us time to respond, and avoid testing against other customers' accounts or data.
This page describes technical measures in place as of the date below; it is not a certification or compliance attestation (e.g., SOC 2, ISO 27001). See our Privacy Policy and Data Processing Addendum for how this relates to data handling commitments. Last updated: October 20, 2026.