How your data moves - and what we do not claim

MizuAlign is bookkeeping and financial analysis software. We help you record, close, and understand your finances.

We do not hold, custody, or transmit your operating funds. Plaid provides read-only bank data for balances and transactions. Stripe on this site bills for the MizuAlign subscription only.

API routes authenticate sessions and scope data by tenant and user. Automated IDOR tests cover cross-tenant denial for core financial resources.

PostgreSQL tenant tables have row-level security policies. Application queries also filter by tenant or user identity.

Sensitive secrets such as bank access tokens and SSO credentials are encrypted with AES-256-GCM using an application encryption key before storage. This is not per-tenant key management.

Data in transit uses TLS to our cloud hosts. Hosted PostgreSQL storage uses provider-managed encryption at rest.

Auth and bank-sensitive rate limits fail closed when the Redis rate-limit backend is unavailable. Stripe webhook handlers verify Stripe signatures before processing events.

Enterprise plans include SAML/OIDC SSO, an append-only audit history with CSV export, and a retention purge job for aged audit events.

We are not SOC 2 Type I or Type II certified. A formal Type I audit engagement has not been signed - status is not yet engaged (PD-013). No invented customer quotes or press logos.

Multi-entity consolidation totals remain under accounting review until FX translation and intercompany eliminations are signed off. Previews are available; signed group books are not claimed.

Enterprise pilots and procurement-ready billing are available through sales for teams that need guided rollout.

In transit: TLS to application and database endpoints.

At rest: provider-managed encryption for hosted PostgreSQL. Application-layer AES-256-GCM protects selected secrets such as bank tokens and SSO credentials.

We do not sell customer data. You can export or delete your account from Settings → Account. Application and auth data are purged immediately after password confirmation; residual backups follow the privacy-policy retention schedule (there is no separate 30-day hard-delete job).

Enterprise workspaces include a SAML 2.0 and OIDC setup wizard for Okta, Microsoft Entra ID, and Google Workspace. Login still has to be configured and tested with your identity provider.

Admins configure identity providers in Settings → Security → SSO after a workspace is provisioned. Optional enforcement can require SSO instead of password login.

Consumer Google sign-in (when enabled) uses MizuAlign’s own OAuth + app JWT flow - not Clerk.

Enterprise includes an append-only history of security and admin events - SSO changes, role updates, exports, and settings modifications.

Compliance teams can filter by actor, event type, and date range, then export to CSV (paginated with cursor for auditor-scale ranges).

A retention cron can purge events older than the configured policy window. Legal hold (AUDIT_LEGAL_HOLD) blocks purge.

Agencies and MSPs can replace MizuAlign branding with their own logo, colors, and custom domain (CNAME).

Configure white-label settings in Settings → White-Label. Client-facing portal pages inherit your brand.

Branded client portal with magic-link authentication - no password required for clients.

Share invoices, proposals with e-sign, and Pay Now flows. Portal settings live under Settings → Portal.

Event-driven automation with delays, retries, and outbound webhooks integrates MizuAlign into your finance stack.

Developer settings include Zapier-compatible endpoints, webhook CRUD, and API keys.

Inbound Stripe webhooks verify signatures. Other provider webhooks require configured secrets before they are accepted.

MizuAlign publishes the controls it currently operates - transport encryption, tenant-scoped API access, Enterprise SSO configuration, and audit history. These controls are not a custody license or a security certification.

Security questionnaires and procurement packages: hello@mizualign.com.

MizuAlign uses the following sub-processors to deliver the Service. Optional vendors apply only when that integration is configured. Enterprise customers may request an updated list at hello@mizualign.com.

We do not use Clerk. Consumer Google login (when enabled) is handled by MizuAlign’s own OAuth integration.

Finance teams can maintain separate legal entities with base currencies and a consolidation hierarchy.

Configure entities under Settings → Legal Entities. Transactions and reports can be scoped per entity.

Consolidated group totals are available as a preview and remain under accounting review until FX translation and intercompany eliminations are signed off.

Add class, location, department, and custom segment tags for granular reporting and budget overlays.

Manage dimensions under Settings → Tracking Dimensions and apply them across expenses and budgets.

Create proposals in the workspace and share a secure public link for client review and e-signature.

Signed proposals are stored with the proposal record. Send links from Proposals in your dashboard.