This page gives a high-level view of the current security posture and operational controls visible in the product. It is intentionally factual and conservative rather than certification-led marketing copy.
Users can enable authenticator-based MFA from Account security. Recovery codes provide an alternative if the authenticator is unavailable; store them securely. MFA is optional and must be enabled for each account.
Stored QuickBooks credentials use encryption. QuickBooks health reports expose scoped operational metadata, including available Intuit trace references, rather than raw response bodies. These reports help investigations; they are not a live connection or worker-health guarantee.
Login is rate-limited and supports Cloudflare Turnstile when configured. In-app support tickets give customers a place to report problems. Contact support promptly about suspected unauthorised access.
Linxis is built around authenticated user accounts, tenant-aware application access, signed API request support for protected integration flows, CSRF protection in browser authentication and state-changing account actions, and sync-job status/history that helps teams review failures, callbacks, and retries.
Browser access is handled through Symfony authentication. New workspaces remain pending until email verification. Registration supports Turnstile, a honeypot and rate controls, while login is rate-limited and uses CSRF validation.
API access in the current application uses bearer credentials, and signed request flows can additionally validate HMAC signatures and timestamps before accepting protected requests.
Authenticated users operate inside a tenant-aware application context. Assistant widgets, knowledge articles, conversations, connections and jobs carry tenant ownership so the application can enforce workspace boundaries.
Linxis keeps operational records for sync jobs, including status changes, callback outcomes, retry paths, and usage-related signals. This helps teams investigate failures instead of treating exports as a black box.
Billing and payment flows rely on third-party providers and dedicated webhook handlers. Customer-authorised integrations such as Magento and QuickBooks remain an important part of the overall data path.
Public vendor references are listed on the Subprocessors page.
If your team needs a DPA, subprocessors list, or help with a security review before approval, use the public documents on this site as the starting point and contact Linxis for anything contract-specific.
If you need a vendor review conversation or a deeper explanation of how the current application works, contact Linxis directly.
support@linxis.uk
WhatsApp 07946 233556
