Audit practices safeguard their clients’ most sensitive financial records. VouchClerk enforces firm tenancy, engagement-team access, two-step authentication, and reviewer independence directly in code.
Every tenant-owned table carries tenant_id — from engagements and normalized accounts to sign-offs and evidence cross-references. Application code runs through tenantDb(tenantId), which injects tenant_id on every read and write and blocks rows from ever moving across firms.
Admins, Partners, and Managers have oversight across every firm engagement. Seniors and Staff see only the engagements whose team they are assigned to — enforced in the data layer via scopedDb the same way firm tenancy is.
Users sign in with bcrypt-hashed passwords plus RFC 6238 TOTP authenticator apps (AES-256-GCM encrypted secrets, 10 one-time recovery codes, replay and brute-force guards) or passwordless WebAuthn passkeys. Admins can require 2FA or a passkey across the entire firm.
During trial balance mapping, only the header row and the first 5 sample rows go to the language model. Firms auditing banks, public entities, or restricted clients can omit the AI key completely and run VouchClerk’s built-in deterministic mapper and classifier.
Uploaded trial balances, bank statements, and invoices are stored under tenant/engagement/kind/uuid keys with path-traversal protection. Documents stream only through authenticated endpoints that verify firm tenancy and engagement membership.
Preparer, reviewer, and approver must be three separate people; nobody approves an AJE they proposed or signs off variance commentary they wrote. Every action, comment, and lock event is timestamped in the activity log.
Because VouchClerk runs on standard PostgreSQL and a clean object-storage interface, we support cloud, dedicated single-tenant, and in-country on-premise deployments.
| Deployment option | Best suited for | Database & file custody |
|---|---|---|
| Managed multi-tenant cloud | Small & mid-size audit firms wanting zero server upkeep | Tenant-isolated PostgreSQL + per-firm encrypted evidence storage, hosted in Johannesburg (Google Cloud africa-south1) |
| Dedicated single-tenant cloud | Firms auditing regulated financial institutions, SACCOs, or NGOs | Dedicated database instance & isolated storage bucket in your chosen region |
| Firm-hosted / on-premise | Practices with strict national data-residency or offline custody rules | Runs on your firm’s infrastructure with local disk vault & offline heuristics |
Note your hosting or compliance requirements when you inquire and we will walk your managing partner and IT lead through the architecture directly.
