Continue with Google
Financial documents
Your financial documents remain private.
Documents remain in private storage. File types and sizes are checked, and sensitive actions require server-side authorisation.
Financial data security
Your financial data deserves more than a password.
Zuelen combines secure authentication, organisation-level access controls, private document storage and trusted infrastructure.
- Isolated workspace per organisation
- TOTP 2FA available
- Stripe-hosted payments
Security never depends on a single barrier.
Each layer reduces a different risk. Together, they protect identity, permissions, data, payments and infrastructure.
- Access requestOpen a bank statement
- UserEvery session begins with a verified user identity in the relevant workspace.Verified
- AuthenticationEmail or Google sign-in, with optional two-factor authentication.Optional 2FA
- AuthorisationEvery sensitive action checks the relevant user, workspace and role.Role checked
- DataDatabase rules and private storage isolate information between organisations.RLS rules
- InfrastructureNetwork, browser and abuse protections complete the system.Safeguards on
- Access grantedIn your workspace only
Your data stays in your workspace.
Financial data belongs to the relevant organisation. Access policies are enforced at database and storage level, not only in the interface.
- Organisation-level RLS policies
- Documents in private storage
- Verified roles and memberships
- Automated cross-tenant tests
You stay in control of access.
Zuelen supports email and password or Google sign-in. TOTP authentication is available and recommended, but always remains optional.
- Controlled sign-in redirects
- Secure password recovery
- TOTP MFA is never forced
- Invitations and roles preserved
Every sensitive flow keeps its own safeguards.
Your records, your payments and AI assistance follow distinct rules, enforced on the server.
Payments
Payments are handled by Stripe.
Zuelen uses Stripe-hosted checkout. Billing events are verified and processed idempotently before a subscription is changed.
- Zuelen
- Stripe Checkout
- Subscription confirmed
- Stripe-hosted checkout
- Verified webhook signatures
- Idempotent processing
- No card data stored by Zuelen
Responsible AI
AI assists you. It never decides your access or permissions.
Zuelen Copilot calls pass through the server and remain subject to workspace controls. AI helps explain available information; it does not change access rights or replace professional advice.
- Limited to authorised context
- API keys kept server-side
- Assistance, not official decisions
Controls continue after sign-in.
Zuelen combines practical operational safeguards for expensive actions, integrations and the browser.
Abuse protection
Reasonable limits protect expensive actions without disrupting normal use.
Input validation
Sensitive inputs are validated before server-side processing.
Security headers
Browser policies reduce injection, clickjacking and context-leakage risks.
Server-side secrets
Private Stripe, Supabase, Resend and OpenAI keys are not exposed to the browser.
Automated checks
Lint, types, tests and production builds are part of the change-control process.
Dependency review
Important dependencies are checked to limit known vulnerabilities.
Specialised services, each with a clear role.
Zuelen relies on established providers for hosting, identity, payments, email and assistance features. Their presence never replaces Zuelen’s own access controls.
Zuelen access controlsUser, workspace and role checked
HostingHosts the web application and delivers its pages through global infrastructure.
Identity and dataProvides authentication, database access, RLS policies and private storage.
PaymentsHandles subscriptions and payments through hosted checkout.
EmailDelivers essential transactional emails sent by Zuelen.
AssistanceSupports selected server-side assistance workflows within authorised context.
Security, answered briefly.
What Zuelen does to protect your data, in plain terms.
A security question?Are my financial documents private?
Yes. Documents remain in private storage. File types and sizes are checked, and sensitive actions require server-side authorisation.
Does Zuelen store my card details?
No. Payments go through Stripe-hosted checkout and Zuelen stores no card data. Billing events are verified before a subscription is changed.
Is two-factor authentication mandatory?
No. You sign in with email and password or with Google. TOTP authentication is available and recommended, but always remains optional.
How is my data kept separate from other companies?
Financial data belongs to your organisation. Access policies (RLS) are enforced at database and storage level, not only in the interface.
Can Zuelen Copilot change my access?
No. Zuelen Copilot calls pass through the server and remain subject to your workspace controls. AI explains available information; it does not change access rights.
Zuelen, wherever work happens
Your financial picture, always within reach.
Use Zuelen from your phone, tablet or computer through its responsive web experience.
Start for freeComing soon on theApp StoreComing soon onGoogle Play