Each firm's data held apart — and every use of it on the record
Every firm's rows are held apart by the database itself, every AI request goes through one governed gateway that records it, backups are encrypted before they leave the server, and a person's personal information can be erased when its purpose ends.
Accounting firms hold their clients' most sensitive financial and personal information. Achekam is built so that a firm's data is reachable only by that firm, every sensitive action is recorded, and retention and erasure follow written policies a person applies.
What it covers
- Isolation in the database — On PostgreSQL every tenant table carries row-level security that the database forces on every query, so one firm's rows are not readable by another's even if application code made a mistake.
- Sign-in and access — Two-factor authentication, single sign-on, directory provisioning (SCIM), IP allow-lists and roles; new sign-ins can alert the person, and sessions can be revoked.
- Governed AI — AI requests go through one gateway with budgets, switches and a record of every request. Before a bank line is sent to a model it is reduced to its date, description, amount and direction, with numbers and recognised names masked; AI on bank lines can be switched off per set of books.
- Retention, legal holds and erasure — Records are kept by the policy of their class, a legal hold always prevails, and disposal is decided by people (a requester, a reviewer and an approver). A person's personal information can be erased, with the erasure recorded. Backups are encrypted with AES-256-GCM before upload.
What it does not do
- The retention periods are configured policies whose legal bases have not yet been confirmed by counsel.
- AI requests are sent to the model providers the platform or the firm configures; each provider's own terms govern what it keeps.
The standard behind it
Protection of Personal Information Act 4 of 2013 (POPIA), Sections 14 (retention) and 19 to 22 (security safeguards). A responsible party must keep personal information no longer than its purpose needs and secure it with appropriate technical and organisational measures.
Questions
- Where is the data held?
- In the platform's managed database and object storage. Ask us for the current hosting regions and the sub-processors that apply to your workspace.
- Can a person ask to be erased?
- Yes. Personal information is erased through a recorded erasure, subject to records the law requires the firm to keep and any legal hold.
