Security and data
Where your clients' data is kept, and how Tolvi protects it
Your clients' trial balances, bank statements, tax figures and meeting notes are personal and financial data. This page sets out where Tolvi keeps them, who can see them and what protects them. It also says what hasn't been done yet.
Last updated
- UK hosting
- AWS London (eu-west-2): app, database, documents, backups and logs.
- Encryption
- TLS in transit; at rest with keys held in AWS KMS.
- Firms kept apart
- Row-level security in the Postgres database itself.
- Tolvi AI
- Suggestions only. It can never sign off or approve.
Which Tolvi products does this page cover?
All of them. Tolvi Hub, Working Papers, Accounts, Corporation Tax, Self Assessment, Meetings, Books and the Admin console run in the same app, with the same sign-in, hosting, encryption and separation between firms.
Where is client data stored?
Tolvi's app, database, document storage, queues, backups and logs run on Amazon Web Services in London (eu-west-2). Client data is held in the UK, apart from Tolvi Meetings recordings, which Recall.ai records and transcribes in the EU and then deletes (see below).
How is the data encrypted?
Connections to Tolvi use TLS. Data at rest, including the database, documents and backups, is encrypted with keys held in AWS Key Management Service (KMS).
How is one firm's data kept apart from another's?
Each firm's data is separated by row-level security in the Postgres database itself, not only by the application. Tolvi has an automated test proving one firm can't read another's data, and every new table must pass it.
Who can see what inside our firm?
Roles control what each person can do: prepare, review, approve, post journals, manage integrations and change settings. Product access is only ever granted by a signed-in admin, never by an API token or an AI assistant.
How do people sign in?
Tolvi never sees or stores your password. Sign-in is handled by a dedicated identity provider, and each firm has its own organisation there, so people can only reach the firms they've been invited to.
Are uploaded documents checked?
Evidence files are uploaded straight to storage for your firm only and opened through short-lived links.
Is there a record of who did what?
Yes. Tolvi keeps an audit log of who did what and when: sign-ins, imports, mappings, journals, review points and sign-offs.
What happens to a client meeting in Tolvi Meetings?
Recall.ai records and transcribes the meeting in the EU (Frankfurt, with transcription in Dublin). As soon as the transcript and summary are saved with the rest of your data on AWS in London, Recall.ai deletes the recording. Each person connects their own Outlook calendar: the access Microsoft grants goes straight to Recall.ai and is never stored by Tolvi, and connecting a calendar records nothing until the person ticks a meeting.
How is Tolvi Books data kept?
Each business's books are kept apart by the same row-level security in the database as each firm's data.
How are tax returns and HMRC sign-ins protected?
National Insurance numbers, dates of birth and repayment bank details on a self assessment return are encrypted separately and only ever shown masked. They aren’t held on the client’s record. It’s encrypted, never shown again, and only used when a manager or partner files a return with a second factor. That is coming: filing from Tolvi isn’t open today.
How are bookkeeping connections protected?
Connections to Xero, QuickBooks Online, Sage Business Cloud Accounting and FreeAgent use each provider's own sign-in, so Tolvi never sees those passwords either.
What does Tolvi AI do with our data?
Tolvi AI only makes suggestions: nothing in the file changes until a person accepts it, and Tolvi AI can never sign off or approve. Your data isn't used to train AI models. Your firm can switch each AI feature off, and every AI action shows its estimated token use before it runs.
Tolvi AI uses Anthropic's Claude models. Where that processing happens, and the sub-processors involved, are set out in the privacy notice.
What hasn't been done yet?
Tolvi hasn't yet had an independent penetration test or Cyber Essentials certification. Both are planned before launch, and this page will say when each is done. Tolvi doesn't hold ISO 27001 or SOC 2.
The sub-processors Tolvi uses are listed in the privacy notice. Before launch we're confirming the data processing agreement terms with each of them.
Questions from your firm
If you need our data processing terms, the list of sub-processors or answers to a security questionnaire, email support@tolvi.co.uk. To report a security issue, use the same address with "Security" in the subject line.
Security questions
Where is my clients' data stored and how is it protected?
Tolvi's app, database, documents, backups and logs run on Amazon Web Services in London (eu-west-2). Data is encrypted in transit with TLS and at rest with keys held in AWS KMS. Each firm's data is separated by row-level security in the database itself, and uploaded evidence is limited to documents, spreadsheets, images and emails, and scanned for malware before it can be opened.
What does Tolvi AI do, and does it change my figures?
Tolvi AI can explain movements, suggest mappings, assist the reviewer, check evidence and draft client queries. Every result is only a suggestion: nothing changes in the file until a person accepts it, and Tolvi AI can never sign off or approve. Your data isn't used to train AI models, each action shows its estimated token use first, and your firm can switch AI features off.
Does Tolvi keep the meeting recording?
No. Recall.ai records and transcribes the meeting in the EU (Frankfurt, with transcription in Dublin). As soon as the transcript and summary are saved with the rest of your data on AWS in London, Recall.ai deletes the recording.
Has Tolvi been independently tested or certified?
Not yet. Tolvi hasn't had an independent penetration test or Cyber Essentials certification. Both are planned before launch, and the security page will say when each is done. Tolvi doesn't hold ISO 27001 or SOC 2.
More answers on the questions and answers page.