Security
Your books are on your machine, and no copy comes to us
Where the records you keep in the software really are, what this company actually holds, and how to tell us about a weakness or a suspected breach.
Reporting a weakness or a suspected compromise? security@murgese.co.uk, and what to send is at the end of this page.
What a breach here would be about
It is worth being precise about this, because the answer is smaller than people expect and the reason is the shape of the product rather than anything clever.
Murgese Ltd holds enquiries sent through this site, download requests, partner applications, pilot applications with what testers tell us during the pilot, and the records of which licence was issued to whom. That is the material a breach of this company would be about.
It does not include your books. Murgese runs on your own machine and keeps your records there. The ledgers, the clients, the VAT returns and the accounts are a file on your own disk or your own server, and no copy of them comes to us. If a firm turns on the optional AI features with its own account, a document it reads, or the figures or wording it asks about, go from its machine to that provider under the firm's own terms. They do not come to us either. The licence is checked on the machine with no call out, so the software does not phone home with a list of what you have. Bank feeds have never been connected to a provider, so no bank credential has ever passed through anything of ours.
The other side of that is worth saying in the same breath: because we do not hold your books, we cannot lose them and we cannot get them back for you either. Your backups are yours, and the software will not let you forget it.
The one way a copy of anything reaches us is by being sent. When you report a problem, send the wording on the screen and a screenshot with anything that identifies a client covered over, never the database, a backup or a full export. If a fault truly needs data, we agree in writing what is sent and what becomes of it.
What the software does on your machine
| The installer is signed | From version 1.93.0 the installer is signed by Murgese Ltd, so Windows names the publisher rather than saying it is unknown. Windows may still warn on the first run of a new release, because the certificate is an ordinary one rather than an extended validation one and reputation with SmartScreen is earned over time. The status page says so rather than telling you the warning has gone. |
|---|---|
| An update is checked before it is installed | The download is checked against the checksum in the release notice, and its signature is checked against Murgese Ltd. An installer that is unsigned, signed by somebody else, or altered after signing is refused on the machine rather than merely reported. Updates are looked for only when somebody asks for them, and can be applied from a file with no internet connection at all. |
| The window it runs in | Electron 44, carrying Chromium M152, which is supported until March 2027. It runs inside the operating system's own sandbox, with context isolation on, Node integration off, a content security policy, and the arguments crossing between the two halves of the application checked. |
| Signing in | Passwords are stored hashed, never in a form anybody here can read. The sign-in page does not tell the network which firm the installation belongs to, and an email address with no account costs a would-be intruder the same time as a wrong password, so a list of addresses cannot be turned into a list of your staff. Repeated attempts are slowed down. |
| When the whole office works on one copy | One Windows PC holds the books and serves them to the rest of the firm, and that link is HTTPS. It is not an option somebody can forget to switch on: sharing will not start over an unencrypted connection, and there is no setting that makes it. The office issues its own certificate authority, so no colleague is taught to click through a browser warning every morning on the software that holds their clients' books, and a PC joining the office checks a short code against the one on the server's own screen. That stops another machine on the office network reading or altering what passes between a colleague and the server. It does not make the server safe to put on the internet, and nothing in the product does. How it is set up is on the why on-premise page. |
| The credentials you set up | The HMRC tokens, the Companies House key and the rest are encrypted, and they are encrypted separately from the books, so a copy of your database is not a copy of your credentials. A backup carries them only in that encrypted form, never the key that opens them, and Windows keeps that key for this Windows account on this PC. The cost of that is deliberate and the software says it out loud: a backup restored onto a new machine brings back every invoice, journal and client and none of the passwords, and those are typed again. Books are irreplaceable and credentials are re-issuable, and a backup carrying both would be one file that hands over a practice. |
| The audit trail notices if it is altered | No screen in Murgese can change an audit entry, but anyone who can open the file underneath it can. So each entry is hashed together with the one before it, and a verification report names the first entry where the arithmetic stops working, and the date it was written. What that does not do is stop somebody determined: a row and every hash after it can be rewritten by somebody who has the file and knows how the chain is built. It turns a silent alteration into one a reviewer can see, which is the part that was missing. |
| Backups you take | The second copy, the one that goes to OneDrive or another folder you choose, can be encrypted. Murgese generates a recovery phrase, shows it once and asks you to type it back before switching encryption on, and we never see it. That cuts both ways and the software says so at the moment you set it: a forgotten phrase is an unopenable backup, which is a second way to lose the books rather than a way to protect them. Keep the phrase somewhere that is not the machine. The encryption is AES-256-GCM with the key worked out from your phrase, and the file carries the settings it was made with, so a copy taken today still opens if those ever change. GCM also means a backup altered in a synced folder fails loudly rather than restoring quietly wrong. An export you send to somebody else can be locked with a password in the same spirit: it is a standard AES-256 zip, which 7-Zip, WinZip and a Mac open; the zip tool built into Windows does not, and the software says so. The copy kept beside the books, and a backup taken with Back up data now, are not encrypted, so an everyday restore needs nothing typed. |
| What Murgese does not do for you | It does not encrypt the working database, which is the live file it reads and writes all day. That is a different file from a backup, and the row above is about backups: the off-site copy can be encrypted, the file sitting on the machine is not. The books sit in a Windows profile on your machine, and the protections around that file are the ones you set: full disk encryption, and a separate Windows account per person rather than one shared login. A laptop that is lost without disk encryption on is a laptop with readable accounts on it, whatever the software does, and it is the one control worth checking before anything on this page. |
This section is about Murgese. Murgese Consolidate is below.
How it is tested, and by whom
Tooling, run by us, continuously. Not a firm we hired, and that difference is set out at the end of this page rather than left for you to infer.
The test suite carries checks for the things that go wrong in software of this kind: permissions, the boundary between one firm's records and another's, signing in, the responses the browser is given, and connections that should refuse to proceed. The whole suite is run before a release goes out, and the build that was tested is the build that ships.
Separately, the dependency tree is audited against the published vulnerability lists, the source is put through security static analysis, and the desktop window's own settings are reviewed by hand, because on a desktop application the window is the way in.
There is a written record of what was run, on what date, what it found, what was done about it and what is still open. If you are assessing us, ask for it.
Murgese Consolidate
It runs on your own machine and keeps no ledger of its own: it reads each company's trial balance and prepares the group accounts there, and no copy comes to us. By default it answers only the machine it is on. A finance team can share one installation across the office network, and that connection is not yet encrypted the way Murgese's is, so until it is, share it only on a network you control. A problem report is a file you read and then choose to send, and it holds counts only: no names, no account descriptions, no figures.
What this website does
It is served over HTTPS. It sends a content security policy, refuses to be framed by another site, declines to let the browser guess at content types, tells another site only that a visitor came from murgese.co.uk, never which page, and turns off the browser features the site has no use for. Pages do not say which programming language or versions the site runs on.
Administrator passwords are stored hashed, and are re-hashed to the current standard the next time that person signs in. Pages carry a token unique to the visitor, which is why nothing generated is allowed into a shared cache. The nightly backup of this site is encrypted with AES-256 under a key derived through 200,000 rounds, and the encrypted file is what is kept.
If something does go wrong
Where a breach of the personal data we hold is likely to be a risk to people's rights and freedoms, we report it to the Information Commissioner's Office within 72 hours of becoming aware of it. Where the risk is high, we tell the people affected as well, without undue delay, in plain language rather than in the language of a legal notice.
If the breach is of a firm's own installation of Murgese, that firm is the controller of those records and the duty is theirs, because we neither hold the records nor have access to them. Tell us anyway if the cause might be the software. We cannot see an installation, and the first we know of a fault is somebody saying so.
What this page does not say
It does not say Murgese is certified, or compliant, or secure. Those words mean particular things, and we would rather set out what is actually in place and let you judge it against what you need.
Where an assessment has been made by somebody outside this company, it will be named here with its date. Nothing is named here today.
In particular, nobody outside this project has been paid to try to break the software. Security tested, for us, means tooling run by the people who wrote it, with the findings and the gaps written down. That is not an independent penetration test and is not offered as one. If your own risk process needs one, that is a fair thing to ask for, and we would rather you asked than assumed the tooling covers it.
Reporting something
Use it for a weakness you have found in the software or this website, and for anything that looks like a compromise. It is read ahead of the contact form and ahead of support. There is a machine readable copy at /.well-known/security.txt.
Do not wait until you are certain. A suspicion reported today is worth more than a confirmed report next week, and nobody here will mind being told about something that turns out to be nothing.
What to send, and what we ask of you
What you found, where, and enough detail for somebody to see it happen. A version number if you have one. The date and rough time helps, because it lets us find the same event in the logs.
Two things we ask. Go no further into anybody's data than you need to demonstrate the problem: showing that a door opens is the finding, and what is behind it belongs to somebody else. And give us a reasonable chance to fix it before you publish, so the people running the software are not reading about it at the same time as the person who can close it.
What happens then
We acknowledge it. We tell you what we find, including when what you found turns out not to be a fault, and we say so rather than going quiet. When it is fixed we tell you that as well, and which release carries the fix. If you would like to be credited, say so and we will; if you would rather not be named, that is the default.
Related
What we do with personal data collected through this site, and your rights over it, is in the privacy notice. What the software does and does not do today, including the things it is not able to file, is on the status page. The agreement the software is supplied under is the software licence.