Your data, protected and backed up every day

Your clients, invoices and payments run through Tandem. Here is how we keep them safe, private and always available.

Soft abstract art in sand and clay tones

Workspace security

Admin

Sign-in protection

Require two-factor sign-in
Single sign-on (SSO)
Sign out after 12h idle
Allow sign-in from new countries
All checks passedby Cassy

Backups

Last backup 02:00

Kept for

30 days

Regions

2

99.98%

Uptime over the last 12 months

AES-256

Encryption for all data at rest

SOC 2

Type II, audited every year

30 days

Daily backups, kept for 30 days

Security built in, not bolted on

The practices behind every account, on every plan. No add-ons to buy.

Encrypted everywhere

Data travels over TLS 1.2 or higher and is stored with AES-256 encryption.

Role-based access

Give each person only what they need. Hide prices, payroll or client notes by role.

Two-factor sign-in

Turn on multi-factor authentication for yourself, or require it for the whole team.

Independent pen tests

Outside security firms test our app and infrastructure at least once a year.

Automatic backups

Daily backups in two separate regions, kept for 30 days and tested every month.

Audit log

See who signed in, what changed and when. Export the log whenever you need it.

Checked by others, not just us

  • SOC 2 Type II

    Audited yearly by an independent firm

  • ISO 27001

    Certified information security

  • GDPR

    EU data processing terms available

  • PCI DSS

    Card payments via certified partners

Security questions, answered

The things IT teams and accountants ask us most.

In secure data centers run by a major cloud provider, in the US or the EU. You choose the region when you sign up, and your data stays there.
Only a small support team, and only when you grant access for a support request. Every access is logged, and you can revoke it anytime.
No. Card payments are handled by PCI DSS certified payment partners. Tandem only stores a reference to the payment, never the card number.
Yes. Export clients, jobs and invoices to CSV at any time. If you close your account, we delete your data within 30 days, backups included.
Yes. We share our latest SOC 2 Type II report and ISO 27001 certificate under a simple NDA. Contact our team and we will send them over.
Send the details through our contact page and choose "Security" as the topic. We reply within one working day and keep you updated until it is fixed.

Need our security pack or a DPA? Our team can send reports, policies and a signed data processing agreement.

Talk to sales

Build with Tandem, ready in days

We move your data over, set things up around how you work, and stay with you until your team is confident.

  • Set up in days
  • Change plans anytime
  • Real human support
Calm abstract art in dusk blue and sand