Security

Today

sanctionsclear.com is a static site served by Cloudflare. There are no user accounts and no database behind it. Form submissions go straight from your browser to Loops.so over HTTPS. Every page is sent with a Content Security Policy that only allows scripts from this site, Google Analytics and Cloudflare.

When the product launches

Sanctions Clear will connect with OAuth and ask for the narrowest access each platform offers for what it does:

• Read contacts, to screen vendors and customers.
• Read transactions, only to see which contact a new bill or invoice belongs to. Nothing else from the transaction is kept.
• Add notes and attachments to contacts, for the screening note and certificate. On Xero, also manage one contact group for possible matches.

It never edits or deletes your records, notes or transactions. QuickBooks Online has no narrower scope than full accounting access, so on QuickBooks those limits are enforced in our code.

• Access tokens will be encrypted at rest and never shown in the app or written to logs. Logs carry IDs and fingerprints, never contact names.
• Webhooks from QuickBooks and Xero are checked against their signatures before anything is processed.
• The review history is append-only: a decision can be annotated but not edited or deleted.
• The service runs on Cloudflare. Subprocessors will be Cloudflare (including Workers AI for match summaries), Stripe for billing and Loops for email.
• Disconnecting the app in QuickBooks or Xero revokes our access straight away.

We will publish the hosting region and the full subprocessor list here before the first account can be connected.

Reporting a vulnerability

If you find a security problem with this site, email [email protected]with the details and steps to reproduce it. We reply within one business day. Please don't run automated scanners against the site or access data that isn't yours.