HTTPS is enforced everywhere. Xero connection tokens and any AI-provider API keys you configure are encrypted at rest. Documents and financial-assessment files (including driver’s-licence scans) are stored on a private AWS disk that’s never reachable by a bare public URL.
