Security is part of LlogariPro's design, not an add-on. The main technical and organisational measures are below.
Last updated 6 September 2026 · LlogariPro · KONSULENCE.AL
All traffic runs over HTTPS (TLS) with valid certificates; unencrypted connections are redirected. Session cookies are Secure and HttpOnly.
bcrypt-hashed passwords, two-factor authentication (TOTP) with one-time backup codes, Google and Microsoft sign-in (OAuth 2.0), login throttling and brute-force protection.
Every user has a role per company: admin, accountant or view-only. Practices invite team members by email and remove them in one click.
API keys are stored only as hashes, shown in full exactly once, carry limited scopes (read, write, import) and can be revoked instantly. Every use is logged.
Hardened servers with firewall, SSH-key-only access, regular security updates and monitoring. The application runs isolated in containers.
Daily backups with 30-day retention, stored separately from the application server. Uploaded documents are isolated per company.
Every transaction is double-entry and cannot be saved unbalanced. Entries keep their source (invoice, bank, payroll, API) and link to the original document.
Found a security weakness? Write to kontakt@konsulence.al immediately. Reports are handled with priority and confidentiality.