Your business, defended in depth
The counter, the ledger and the payroll hold the most sensitive numbers a business has. Here is exactly how Sero protects them.
Tenant isolation
Every API request is scoped to one business. One customer’s data is never reachable from another’s session.
Encryption
TLS in transit and encryption at rest. SeroPayroll company files are encrypted locally with a recovery key.
Server-enforced permissions
Roles are checked on the server, not just hidden in the interface — 207 permission nodes in SeroBooks.
Append-only audit trail
Who changed what, and when, recorded in a log that cannot be edited after the fact.
Period locks
Closed periods are locked at the ledger, so a filed return cannot quietly change underneath you.
Safe money documents
Idempotency keys stop a double-tap or retry from creating a payment or pay run twice.
Step-up authentication
OAuth token sessions, with a second check before sensitive actions.
Cards stay in the terminal
Card data is handled by certified payment terminals and processors; Sero never stores card numbers.
Bank credentials stay with the bank
Bank connections go through Plaid, so your banking credentials never touch Sero.
Security claims should be architecture, not adjectives
We describe how the products are built rather than promising that they are secure. The controls above are in the code today, across SeroPOS, SeroBooks and SeroPayroll, and run on Microsoft Azure infrastructure.
Native apps are signed and notarized, every release passes more than a hundred automated checks, and nightly tie-outs compare the books to themselves so a broken total is caught before you see it.
Privacy
Your business data belongs to you. We process it to run the service, we do not sell it, and we do not use it to train AI models. Our privacy policy is shaped around Canada’s PIPEDA and explains what we collect, why, who processes it and how long it is kept — including the six-year retention the CRA expects for business records.
Certifications
Formal compliance certifications are on our roadmap and will be announced when they have been audited — never before. If your organisation needs a security questionnaire completed, contact us and we will answer it plainly.
Frequently asked questions
Where is my data hosted?
Sero products run on Microsoft Azure. SeroPayroll can also keep company files locally on your Windows computer, encrypted with a recovery key, with optional cloud sync.
Does Sero store credit card numbers?
No. In-person card payments are handled by certified terminals and processors such as Global Payments and Moneris, and subscription payments by Stripe. Sero never sees or stores full card numbers.
How do I report a security issue?
Email support@serohq.com with the details and we will respond promptly. Please give us reasonable time to fix an issue before disclosing it publicly.