Data residency is usually a line in a sales deck. Here it's an architecture decision you can check: one region, encrypted storage, and tenant separation enforced by the database rather than promised by the app.
Nummo runs in AWS's Montreal region. Not "mostly" Canada, not a Canadian front end over an American database — the application, the ledger and the documents are all there.
There is no overnight sync to a US region and no third-party processor holding a copy of your ledger to make a feature work.
Firms with public-sector or regulated clients get asked where the data sits, in writing. The answer is short, and it doesn't have an exception in it.
Most accounting platforms keep every customer in one database and rely on application code to filter each query. One missed WHERE clause and a business sees somebody else's ledger.
Nummo pushes that rule down into PostgreSQL itself. Every table carrying business data has row-level security switched on and forced, so a query that forgets to filter returns nothing at all rather than the wrong company's numbers. The database is the last line, not the app.
Talk to us about a security reviewThe database volumes are encrypted with AWS-managed keys. A disk that walks out of a datacentre is unreadable.
Every connection uses TLS, and the application verifies both the certificate chain and the hostname before it sends a single query.
It sits in a private, isolated subnet with no route out. The only thing that can talk to it is the application itself.
Database credentials and payment keys live in AWS Secrets Manager and are handed to the application at run time.
The production database is backed up automatically and kept for fourteen days, with point-in-time recovery across that window — so a mistake made on Tuesday can be undone to Tuesday morning, not just to the last nightly dump.
It also carries deletion protection: the production books cannot be torn down by an accidental command, and a teardown would leave a snapshot behind regardless.
People are invited to a specific business with a specific role. Removing someone removes their access to that business immediately.
Firms connect through their own login and their own portal. Nobody shares credentials to get the year-end done.
Posted entries aren't quietly edited away. The audit log records what changed, who changed it and when.
If your firm needs this in writing for a client file, ask — we'd rather answer it properly than leave you guessing.
Tell us where your books live today and we'll show you exactly what switching looks like — usually a single call and a file.