Squava, LLC (“Squava,” “we,” “us”) builds cloud software for professional services firms. Customers use Squava to track time, run projects, bill clients, manage expenses, and keep financial records.
This page describes how we protect that data. It covers the Squava websites, the Squava application, and the related APIs. Our Privacy Policy explains what personal information we collect and how we use it. Our Terms of Service is the contract for using the service.
Customer data in Squava includes account and user profiles, time entries, projects, schedules, clients, invoices, bills, expenses, payroll-related records, accounting records, and files a customer uploads.
If a customer connects a bank, we also process the transaction data imported through that connection. If a customer connects a payments, payroll, expense, or e-signature integration, we process the records needed for that connection.
Each customer account is stored in its own database, separate from other customers. Application access to a customer database is tied to that customer’s authenticated users.
Customers choose who can use their account and what those people can do. Administrators can invite users and set permissions. Customers should remove access when someone leaves the firm.
Passwords are stored as salted scrypt hashes. We do not store plaintext passwords. Password reset links expire.
Sign-in uses a session key stored in an HttpOnly cookie that is sent only over HTTPS. Authenticated requests use CSRF protections. Sessions expire, and signing out ends the session.
Squava staff can access production systems and customer accounts only when they need to for operations or support. We remove that access when the person no longer needs it.
Squava is served over HTTPS. Traffic to the application is encrypted in transit with TLS.
We keep production servers and databases on access-controlled systems. Administrative access is limited to authorized personnel.
We design the application to accept only authenticated, authorized requests, and we protect state-changing requests against cross-site request forgery.
Card payments for Squava subscriptions are processed by a third-party payment processor. Squava keeps billing records such as subscription status and payment results. Cardholder data stays with that processor.
If you connect a bank account, a bank-connection provider handles the bank credentials. Squava uses that connection only to import the transactions you bring into the product.
We use service providers to operate Squava, including hosting, email, payments, and bank connections. They may process customer data only to perform the service they provide to us, and only under terms that require them to protect it.
If you connect another product to your account, that provider receives only the data needed for that connection. You can disconnect an integration when you no longer want that provider to receive your data.
We keep backups of customer databases so we can recover from a failure. Access to backups is limited to authorized personnel.
We use reasonable efforts to keep Squava available. The service may be unavailable during maintenance or events outside our control. When we can, we post planned maintenance in advance.
If we confirm a security incident that affects customer data, we will:
Contain the incident and investigate what happened.
Determine which data and which customers were affected.
Notify affected customers without undue delay, including what happened and what we are doing about it.
Notify regulators when the law requires it.
Fix the cause and review how we handle this class of issue.
We keep customer data while the account is active and for as long as we need it to provide the service. We may also keep limited records when we need them for billing, security, or legal obligations.
When an account is closed, the customer is responsible for exporting data they want to keep. After closure, Squava may delete the customer database and stored files. Our Terms of Service describe what happens to data when an account ends.
You are responsible for:
Choosing a strong password and keeping it private. Squava will not ask for your password by phone or in an unsolicited email.
Deciding who has access to your account, and removing people who should no longer have it.
The accuracy of the data you enter.
The security of your own devices and networks.
Reviewing any integration you connect, and disconnecting it when you no longer want that provider to receive your data.
If you believe you have found a security vulnerability in Squava, email privacy@squava.com with a description of the issue and how to reproduce it. Please give us a reasonable chance to investigate and fix it before any public disclosure.
We welcome good-faith reports. A good-faith report does not access another customer’s data, does not disrupt the service, and does not copy data out of the system beyond what is needed to demonstrate the issue.
We review this page as our practices change, and at least once a year. The date at the top is the current version.
Security and privacy questions: privacy@squava.com
General contact: contact@squava.com or 1-888-773-3258
Squava, LLC