Security at Hengo

Data encryption

All data in Hengo is encrypted at rest using AES-256 encryption and in transit using TLS 1.3. Sensitive fields such as API credentials, bank connection tokens, and exchange API keys are encrypted with an additional field-level encryption layer using a dedicated encryption key.

Encryption keys are managed through a secure key management system and are rotated regularly. No Hengo employee can access your encryption keys or decrypt your sensitive field-level data without explicit authorization.

Data residency

Hengo offers data residency options in Canada, the United States, and Costa Rica. Your workspace data is processed and stored in the region you select, ensuring compliance with cross-border data protection requirements like PIPEDA (Canada), CCPA (California), and GDPR (EU).

You can set your data residency when creating a workspace. Once set, it cannot be changed without a formal data migration request, ensuring your data never moves to a different jurisdiction without your explicit consent.

Access control and authentication

• Two-factor authentication (2FA): TOTP-based 2FA is available for all users and strongly recommended for admin and accountant accounts.
• Role-based access control (RBAC): Granular roles (firm owner, firm staff, client admin, client user, read-only) ensure each person sees only what they need.
• Row-level security (RLS): Data isolation at the database level ensures one workspace cannot access another workspace's data.
• Session management: Active session tracking, remote session revocation, and automatic session timeout.
• Password policies: Configurable password strength requirements and password history tracking.

Audit trail and immutability

Every financial transaction in Hengo is recorded with an immutable audit trail. Journal entries that have been posted cannot be edited or deleted — corrections must go through a new reversing entry, ensuring a complete and tamper-proof history of all financial changes.

The audit log tracks who did what, when, and from where (IP address and user agent). This log is available to workspace admins and can be exported for compliance reviews or external audits.

SOC 2 and compliance

Hengo's SOC 2 audit is in progress. We follow SOC 2 control principles (security, availability, processing integrity, confidentiality, and privacy) and collect SOC 2 evidence continuously through automated workflows. Our compliance program includes:

• Quarterly access reviews to verify that only authorized users have access to sensitive data
• Monthly dependency scans to identify and patch vulnerable third-party libraries
• Continuous security event logging and anomaly detection
• Vendor risk assessments for all third-party integrations
• Data retention policies with automated purge schedules
• Breach response procedures with documented incident handling

Data export and deletion

You own your data. Hengo provides a full data export feature that downloads all your workspace data in a structured format. You can request a data export at any time from Settings.

If you cancel your subscription, your data remains accessible for 30 days. After that, it is permanently deleted in accordance with our data retention policy. You can also request immediate data deletion at any time.

Frequently asked questions