Security at Recido

Recido holds the records your business runs on — invoices, customers, sales, stock. Here is what we do to protect them, stated plainly.

How we protect your data

• Encryption in transit. The app, our API and this website communicate over HTTPS (TLS).
• Hashed passwords and passcodes.Passwords are hashed with bcrypt, and in-app business passcodes are stored as hashes. We can’t read either.
• Access controls.Every API request is authenticated, and access to a business’s data is checked against the user’s membership, role and permissions in that business.
• Restricted internal access. Only the people who operate the service can access production systems.
• On your phone.Login tokens are kept in the operating system’s encrypted secure storage, and you can lock the app with Face ID, fingerprint or your device PIN. Biometric checks happen on your device; we never receive biometric data.
• Minimal diagnostics. Crash reports identify you by user ID, not email, and session replays mask all text and images.
• You stay in control. You can export your data and delete your account from the app. See the privacy policy for what we collect and how long we keep it.

No system is perfectly secure. Use a strong, unique password, keep your phone locked, and remove team members who no longer need access.

Reporting a vulnerability

If you believe you’ve found a security issue in Recido or this website, please email security@recido.app. Include enough detail for us to reproduce the issue, and please give us a reasonable chance to fix it before sharing it publicly. We’ll acknowledge your report and keep you updated while we work on it. We won’t pursue legal action against researchers who act in good faith, avoid accessing other people’s data, and don’t disrupt the service.

If something goes wrong

If a security incident affects your personal information, we will notify you and the relevant regulators as required by law.