Enterprise-grade by design.
Built for the security reviews your compliance team actually runs.
Request documentation →NDA required · 1-day turnaround
What we hold
Certifications, commitments, and the paperwork we’ll sign.
- SOC 2 Type II
- Independently audited controls across every system.
- SOC 1
- Controls over financial reporting, examined by a licensed CPA.
- SOX-aligned
- Segregation of duties and approval trails your auditor already expects.
- No training on your data
- Your ledger never becomes someone else’s model.
- HIPAA-configurable
- Deployable under a BAA when protected health information is in scope.
How it’s built
- Your data is encrypted end to end
- All data transmitted through Billow and our Excel add-in is encrypted using TLS 1.3. Data stored within our systems is encrypted at rest using AES-256. These safeguards cover confidentiality and integrity across every phase of data handling.
- Isolated, filtered cloud infrastructure
- Our infrastructure runs on Railway, with encrypted private networking between services. Public traffic is protected through managed edge networks, including Cloudflare for DDoS mitigation, bot detection, and edge-level filtering.
- AI data handling by product
- Retention depends on the product and provider settings. Our free Transaction Categorizer uses OpenAI’s standard API settings: submitted transaction details may be retained in abuse-monitoring logs for up to 30 days, with legal and safety exceptions. Billow does not save the uploaded file. See our privacy policy for the full processing and retention details.
Send us your security questionnaire.
We’ll return the completed questionnaire, the SOC report, and our subprocessor list. Most reviews close in a single pass.
NDA required · 1-day turnaround