Founding venues get half price for their first 12 months. See pricing
margn
Log inStart free

Security

Your invoices, looked after properly.

Margn reads your supplier bills so it can check them. That's sensitive business information, so here's exactly how we look after it, in plain English.

Read-only

Margn reads your bills. It can't pay, approve, edit or delete anything in Xero or MYOB.

Encrypted

Everything travels over HTTPS and is encrypted where it's stored.

Two-step login

Add a code from an authenticator app on top of your password.

Kept in Sydney

Your invoices, files and database live in Australian data centres.

The detail

What Margn can see

  • With Xero we ask only for read access to bills and supplier contacts. We never see your bank accounts or payroll.
  • With MYOB we read purchase bills and suppliers from the one company file you choose.
  • Margn never creates, changes, approves or pays anything in your accounting software.
  • You can disconnect at any time from Settings, or from Xero or MYOB directly.

Encryption

  • Every page and file goes over HTTPS (TLS), with strict transport security switched on.
  • The database and file storage are encrypted at rest by our hosting providers.
  • Xero and MYOB keys and two-step secrets get a second layer: AES-256 encryption before they're saved.
  • Passwords are hashed with scrypt. We never see or store the password itself.

Signing in

  • Two-step login with any authenticator app, plus ten one-time backup codes.
  • After a few wrong passwords or codes, that sign-in is locked for 15 minutes.
  • Each person on your team has their own login and role: owner, admin, member or viewer.
  • You can see your own recent sign-ins in Settings, Security.

Private, and only shared anonymised

  • To show how prices compare, Margn combines prices from many venues, yours included, into anonymised ranges. A range only appears when at least five other venues buy the same item, so no single venue's price can be seen or worked out.
  • Other venues never see your invoices, your prices or your name, and your data is never sold or used to train AI models.
  • Every business's data is kept separate, and every request is checked against the business it belongs to.

Activity log

  • Owners and admins can see who signed in, who joined, who changed settings, connected an integration or exported data.
  • The log can't be edited, even by us from inside the app, and it's kept for 400 days.

Supplier reply links

  • When you query a price, your email can carry a link so the supplier can answer in one click.
  • The link shows only that one query, nothing else from your account.
  • Links are long and random, can't be guessed, and stop working after 90 days.

You're in control

  • Download all your invoices, flags and settings at any time.
  • Delete your business and its data from Settings when you leave.
  • Our privacy policy explains your rights under the NZ Privacy Act 2020.

Who helps us run Margn

  • Vercel hosts the app and stores uploaded files, in Sydney.
  • Neon runs the database, in Sydney.
  • Resend sends our emails. Sentry receives error reports, with invoice details and personal information stripped out first.
  • Xero and MYOB, only if you choose to connect them.

Certifications

Margn is young and we'd rather be straight with you: we don't hold SOC 2 or ISO 27001 yet. We build to those standards from day one, and we'll go for formal certification as we grow. If your group needs a security questionnaire filled in, send it over and we'll answer it honestly.

Found a security problem?

Please email james@margn.co.nz with what you found and how to see it. Please don't access other people's data or disrupt the service while testing. We aim to reply within two working days, and we won't take action against anyone reporting in good faith.

Want the legal version? Our privacy policy and terms cover the same ground in more detail.

Ask us a question