Trust

Trust & security

Last updated: 8 October 2026

TMonie holds financial records, so we treat protecting them as part of the product. This page explains, in plain language, what we do and what you can do.

TMonie never holds your money

TMonie is a planning, invoicing and record-keeping service. It does not hold funds, make bank transfers or pay bills for you. Subscription payments are taken by Stripe, and card details go straight to Stripe without passing through TMonie.

If you switch on online invoice payments, you link your own Stripe account. Your customers pay you directly through Stripe, the money goes to your Stripe account and then your bank, and TMonie only records that the invoice was paid. Stripe is a regulated payment provider and carries out the identity and security checks.

Your records stay yours

• Separated by design. Every account and every business can only read its own records. This is enforced inside the database, not just in the app.
• Team roles. In a Business workspace, owners decide who can create, approve or only view records. Financial reports are limited to the owner, accountant, auditor and approvers, and every change is recorded in the activity history.
• Encrypted. Information is encrypted in transit (HTTPS) and at rest.
• No selling, no advertising. We do not sell personal information or use it for advertising.
• Your copy. You can export your data or delete your account from Privacy & data at any time.

Protecting your account

• Two-step verification with an authenticator app or text message, in Settings & security.
• Sessions time out, and sign-in, password reset and other sensitive requests are rate-limited.
• We will never ask for your password, card number or online banking details by email, phone or in Ask TMonie.

Ask TMonie, our AI assistant

• Optional. Nothing is sent until you agree to its notice, and you can stop using it at any time.
• Private by default. It only explains how TMonie works unless you switch on “Use my records”. In a business, the owner must allow that first.
• Names hidden. Customer, supplier and project names are replaced with labels such as [Customer 1] before anything is sent, and bank details, email addresses and notes are never sent.
• Read-only. It cannot make payments, approve, send or change anything.
• Not trained on your data. Our AI provider, Anthropic, does not use what is sent to train its models, and TMonie does not store the conversation.
• Not advice. Answers can be wrong and are general information, so check figures on the page and get professional advice before acting.

The companies we rely on

We use established providers for hosting (Vercel), database and sign-in (Supabase), payments (Stripe), email (Resend) and the optional AI assistant (Anthropic). Each processes information only on our instructions. The full list is in the privacy notice.

If something goes wrong

We monitor the service for errors and unusual activity and follow a written incident plan. If a security incident affects your personal information and is likely to put you at risk, we will tell you and the regulator without undue delay, explain what happened and what we are doing about it.

Report a security issue

If you think you have found a security problem, please email security@tmonie.com with the details. Please do not access other people’s data, and give us a reasonable time to fix the issue before sharing it. We will acknowledge your report and keep you updated.

What we are still working towards

TMonie is a young service and we prefer to be honest about that. We have not yet completed an independent penetration test or a formal certification such as ISO 27001 or SOC 2; these are planned as TMonie grows, and this page will be updated when they are done.