Security

Reporting a vulnerability

If you have found a security problem in Acquit, email [email protected] with "Security issue" in the subject line.

Useful things to include: what you found, the URL or endpoint, the steps to reproduce it, and what an attacker could do with it. Screenshots help. If you need to send something sensitive, say so and we will arrange a way.

Please do not run automated scanners against the live site, access or modify data belonging to another firm, or degrade the service for anyone else. If you find someone else's data, stop and tell us rather than confirming how much you can reach.

We will not pursue legal action against anyone who reports a genuine issue in good faith and follows the above. We do not run a paid bounty programme, and we will credit you on this page if you would like that.

How quickly we respond

We acknowledge every report within one business day. Once we have confirmed and rated an issue, we work to these targets:

Severity	What it means	Fixed within
High	Client data exposed across firms, authentication bypassed, or remote code execution	As soon as possible, ahead of all other work
Medium	Exploitable, but needs an authenticated account or unusual conditions	3 business days
Low	Limited impact, or theoretical without a practical attack	3 weeks

We will tell you when the fix is live. If a report affects other firms' data, the affected firms hear from us directly.

How Acquit is built

Every connection uses HTTPS. Traffic reaches Acquit through Cloudflare, and the origin server refuses connections that do not come through it.

Passwords are stored as salted scrypt hashes, never as passwords. Two-factor authentication is mandatory on every account, and passkeys are supported as a stronger alternative to codes.

Each firm's data is separated at the query level: a request for a client record filters on the owning account before the database is asked, and a record that is not yours returns a 404. That separation is covered by an automated test suite of deliberate cross-tenant attacks, which runs in CI on every pull request.

Alongside those tests, every change is checked by a static analysis pass that fails on missing ownership filters, unescaped user input in queries, unsafe HTML, and secrets in source. Dependencies are scanned weekly for known vulnerabilities. Secrets live in the server environment, never in the code repository.

Uploaded files are never served from a public directory. They are written to private storage, checked by content rather than by filename, and served only through routes that confirm the requester owns them.

Application errors are shipped off the server as they happen, and uptime is monitored independently at status.acquit.app. Access and administrative actions are logged and kept for 12 months.

Where your data lives

Your firm's records stay in this part of the world. The database, its backups and the application server are all in Sydney, and uploaded files are pinned to the Oceania region rather than left to a global default.

Data	Location	Held by
Clients, court dates, tasks, notes, messages, account records	Sydney, Australia	MongoDB Atlas
The application and its short-term caches	Sydney, Australia	Acquit (dedicated server)
Uploaded files: scans, attachments, images	Oceania	Cloudflare R2
Backups	Sydney, Australia	MongoDB Atlas

Who else processes your data

These are the services Acquit relies on. Each one receives only what it needs to do its job.

Service	What it does	Processed in
MongoDB Atlas	Primary database and backups	Australia
Cloudflare	Traffic protection, DNS, and file storage	Files in Oceania; traffic filtering at the nearest edge
Microsoft	Calendar sync and sign-in, inside your own Microsoft 365 tenant	Your tenant's region
Google	Sign-in only, if you choose to use it	United States
Resend	Sending transactional email	United States
Stripe	Subscription billing. Acquit never sees your card number	United States
Better Stack	Error logs and uptime monitoring	Germany
Anthropic, OpenAI	The optional AI features only, and only for the text those features are given. Neither trains on your data	United States

AI features are opt-in per category and can be turned off in Settings. When they are off, nothing is sent to Anthropic or OpenAI.

Getting your data out, and getting rid of it

You can download everything Acquit holds about you at any time, from Settings. It arrives as a JSON file covering your profile, clients, court dates, tasks, notes and activity history. This works even if your subscription has lapsed.

There are two ways to close an account:

Option	What happens	Erased after
Deactivate	Sign-in is blocked immediately. Your data is held so the account can be restored if you change your mind	90 days
Delete permanently	Billing stops immediately. You can cancel until the scheduled date, after which nothing can be recovered	7 days

Both end the same way. Records that are yours alone are deleted outright. Records shared with another firm, such as a court appearance someone else covered for you, keep the appearance but have your name and contact details removed, because the other firm has its own history to keep.

Two things outlive the account by design: payment records, which Australian tax rules require us to keep for five years, and security audit logs, which are kept for 12 months with the username removed.

If you would rather ask a person than click a button, email [email protected] and we will handle it for you.

If something goes wrong

Acquit has a written incident response procedure covering how an incident is detected, contained, investigated and reported, and a recovery plan for the loss of the database, the server, or an external service.

If a breach affects your firm's data, we will tell you what happened, what data was involved, and what we have done about it. Where the Notifiable Data Breaches scheme applies, we notify the Office of the Australian Information Commissioner as well, within the time the scheme requires.

The database is backed up continuously, with point-in-time recovery to any second in the last seven days and monthly snapshots kept for a year. Backups are only worth what a restore proves, so we test them: the last verified restore was on 28 July 2026, checked collection by collection against live data, including every index.

Live service status is at status.acquit.app.

What we hold, and what we don't

Acquit is a small Australian company. We do not hold SOC 2, ISO 27001 or PCI DSS certification, and we would rather say so than imply otherwise. Card data never touches our servers, so PCI scope sits with Stripe.

Acquit is bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth). Our Privacy Policy sets out what we collect and why, and our Terms of Service cover the rest of the relationship.