We respect your business data privacy. All customer, supplier, and invoice records remain strictly on your self-hosted database server. Passwords are stored using cryptographic Bcrypt/Argon2 hashing, and API sessions use signed short-lived JWT access tokens.