Security

Installing an unknown program on the computer that holds a company's books is a reasonable thing to worry about. So we're designing the agent to need as little trust as possible: it can only do what Sage 50 allows it to do, nothing can reach it from the internet, and everything it does is visible and reversible.

Early access. This page describes how the agent is designed and the rules we follow. Items marked before general release are not finished yet.

Start without risk

Your customer decides how far to go, one step at a time:

1. Sage demo company. Try everything on the sample company that ships with Sage 50. No real data is involved.
2. A copy of the books. Restore a Sage 50 backup on a spare PC or virtual machine. The live company file is never touched.
3. Live company, read-only. Connect the real company through a Sage 50 user with read-only rights, and choose which records to share.
4. Write back. Turn on creating invoices, bills or payments — one type at a time — only when you're ready.

What the agent can access

• Sage 50 sets the limits. The agent signs in to Sage 50 as its own user (for example “AcctRelay”). Sage 50 lets the owner restrict what that user — and third-party products — may do. With read-only rights, Sage 50 itself refuses any change, whatever the agent asks for.
• You choose the data. Each record type (customers, vendors, invoices, bills, payments, accounts, items) is switched on separately. Payroll and employee records are off by default.
• Only the connected company. The agent works with the Sage 50 company file it was connected to. It does not read other files, documents, email or browser data on the computer.

How it connects

• Outbound only. The agent opens one encrypted HTTPS connection out to api.acctrelay.com. It opens no ports on the computer and needs no VPN, port forwarding or remote desktop — there is nothing for anyone on the internet to connect to.
• Easy for IT to check. Because there is one destination, an administrator can allow only api.acctrelay.com in the firewall and confirm that nothing else leaves the machine.
• One key per company. Every connected company has its own key. Revoking it cuts that company off immediately without affecting anyone else.

What we store

• No copies of the books. Records pass through our servers to the app that requested them. We do not keep a copy of the company's accounting data.
• Minimal logs. Our service logs record when a request was made, which endpoint was called and how many records were returned — not the contents of the records. They are kept for up to 30 days.
• More detail is in our Privacy Policy. A data processing agreement (DPA) is available for partners before general release.

Everything is visible and reversible

• Local activity log planned The agent will keep a plain-text log on the customer's computer: the time of every request, what was asked for and how many records were sent.
• Pause in one click in the agent. planned
• Revoke access at any time — in Sage 50, or by revoking the company's API key. planned
• Uninstall like any Windows program. The agent leaves nothing behind inside the Sage 50 company file.
• As with any change to accounting software, back up the company in Sage 50 before you connect it.

How you can verify us

• Signed installer — Windows shows AcctRelay as the publisher instead of “Unknown publisher”. before general release
• Malware scan report for every agent release, published on this page. before general release
• Architecture review for partners. Design partners who need it can review the agent's architecture and security design under an NDA.

Reporting a security issue

If you find a vulnerability, email stepan@acctrelay.com with the subject “Security report”. We reply within two business days and won't take action against good-faith research.

AcctRelay is an independent product built on Sage's official SDK. It is not affiliated with or endorsed by The Sage Group plc.