ER Finance

Privacy Policy

Last updated 8 August 2026

ER Finance is internal software operated by Ezekiel Rain for its own financial reporting. It is not a public service, it is not offered to customers, and it has no public sign-up. Access is by invitation only, limited to authorised Ezekiel Rain staff and board members.

This policy describes what the application stores, where it stores it, and who can reach it.

What data the application holds

  • Accounting records synced from QuickBooks Online — chart of accounts, journal entries, bills, invoices, payments, deposits, transfers, and the vendor and customer records those transactions reference, for the two Ezekiel Rain company files.
  • Budgets and financial planning data entered by Ezekiel Rain staff.
  • Published foreign exchange rates retrieved from public sources, including the Bank of Thailand.
  • Account details for authorised users — name, email address, and role — supplied by our identity provider when a user is invited.

What it does not do

  • No advertising, and no advertising identifiers.
  • No analytics or behavioural tracking.
  • No sale, rental or sharing of data with third parties.
  • No collection of personal information from members of the public.

QuickBooks Online access is read-only

The application connects to QuickBooks Online through Intuit’s official OAuth 2.0 authorisation flow, and only ever reads. It does not create, modify or delete anything in QuickBooks. This is enforced in code: the HTTP client rejects any request that is not a read, so a write cannot be issued even by mistake.

Ezekiel Rain can revoke the connection at any time from within QuickBooks Online, under Apps, without needing to contact us. Access tokens are encrypted at rest and are never displayed in the interface or written to logs.

Where data is stored, and how it is protected

  • Data is held in a managed PostgreSQL database hosted by Supabase in the Singapore (ap-southeast-1) region.
  • Encrypted in transit using TLS, and encrypted at rest.
  • Credentials and OAuth tokens are held in dedicated encrypted secret storage, separate from application data.
  • Authentication is handled by Clerk. Row-level security in the database restricts each account to the data its role permits.
  • The application is hosted on Vercel. All access requires an authenticated session, apart from this page and the terms page.

Sub-processors

The application relies on Intuit (QuickBooks Online), Supabase (database hosting), Clerk (authentication) and Vercel (application hosting). Each processes data solely to provide its service to Ezekiel Rain.

Retention

Accounting records are retained for as long as they are needed for financial reporting, audit and statutory record-keeping. If the QuickBooks connection is revoked, synchronisation stops immediately; previously synced records are retained under the same terms unless deletion is requested.

Questions or requests

Contact joelk@erthailand.org. Material changes to this policy will be published on this page with a revised date.