Your accounts, your control.
Security starts with how access works. Where the work needs one of your accounts, you invite us from that account, at the access level the job needs: read-only for banks and cards. Your passwords stay with you, and you can remove our access at any time.
Access by invitation · your passwords stay with you · two-step portal sign-in
Access map
- Bank & payment accountsYour US company's accounts Read-only MFA ✓
- Sales channelsYour marketplace or store Read-only MFA ✓
- Your documentsID and company documents in your quote Sent by you MFA ✓
Your controls
- Invited from your account ✓
- Passwords stay with you ✓
- Filed only on your approval ✓
- Remove access any time ✓
Invited by you, at the level each job needs.
You invite us read-only from your own accounts, so your passwords stay with you.
Banks and payment accounts
Read-onlyWe see transactions to reconcile them. With read-only access, money moves only when you move it.
Sales channels
Read-onlyOrders, payouts, fees and refunds, so every payout is matched to its sales.
Your documents
Sent by youYou send the ID and company documents listed in your quote.
Your filings
Your approvalA named reviewer checks your file. Every filing goes to a government office after you approve it.
Your money stays in your own accounts; you approve and send every payment.
Your documents, behind two-step sign-in.
Documents, messages, reports and invoices live in your client portal at portal.limenorth.com. These controls are built into it.
Two-step sign-in
Email link + app codeThe portal is by invitation only. You sign in with a one-time email link and a code from an authenticator app. The database itself refuses data to a session that has not passed both steps.
Your company only
Enforced in the databaseRow-level rules in the database tie every record to its client, so each client reaches only its own documents, messages and reports.
Private file storage
2-minute linksFiles sit in private storage. Each one opens through a link made when you click, which stops working after 2 minutes.
Who viewed your files
Visible to youEvery view and download of your files is recorded with a name and time, and you can read that record in your portal.
Download all your records from the portal at any time.
Controls built into the work.
Who hosts your data.
Connections to this website and to the portal are encrypted with HTTPS (TLS 1.2 or newer), and browsers are told to use the encrypted connection every time.
Supabase
Database, files and sign-in · US EastSupabase states that all customer data is encrypted at rest with AES-256 and in transit via TLS, that it is SOC 2 Type 2 compliant and that it is ISO 27001 certified.
Vercel
Runs the portal applicationVercel states that data is encrypted at rest (AES-256) and in transit, that it has a SOC 2 Type 2 attestation and that it is ISO 27001:2013 certified.
Resend
Sends portal emailsResend states that it provides encryption at rest (AES-256) and in transit, and that it is SOC 2 Type II compliant.
Certifications above are each provider's own, as stated on its security page. Links are in the sources below.
You can remove our access at any time.
Every connection lives in your own accounts, so you can remove it yourself, whenever you choose. When an engagement ends, we remove ourselves from each one.
- Access granted by your invitation
- Removable from your own accounts
- Every filing approved by you before it is sent
- We remove ourselves when an engagement ends
How long we keep what you send.
Client records
7 yearsKept for 7 years after our engagement ends, or for the period your engagement letter states.
Identity documents
90 daysID documents sent for an ITIN application are scheduled for deletion when that work is complete, then deleted from storage automatically 90 days later.
More detail is in our privacy policy.
If something goes wrong
If we confirm that your information was accessed without permission, we tell you within 72 hours: what happened, what it affected and what we are doing about it.
Reporting a security concern
Spotted something that looks wrong, in the portal or on this site? Email us and we'll look into it: hello@limenorth.com
Request our security overview.
A short document for you or your advisers: how the portal protects your data, who hosts it, and the written policies we keep. Email us and we'll send it.
Sources
- Supabase: Security · fetched 23 October 2026
- Vercel: Security · fetched 23 October 2026
- Resend: Security · fetched 23 October 2026
Questions about access and security
What access do you need?
You send the ID and company documents listed in your written quote. Where the work needs one of your accounts, you invite us from that account at the level it needs: read-only for bank, payment and sales accounts.
When is anything filed?
Every filing goes to a government office after you approve it.
Do you use multi-factor authentication?
Yes. Everyone who signs in to the client portal, client or team member, uses a one-time email link and an authenticator app code, and we use multi-factor sign-in on the accounts we use to reach your records.
Where is my data stored?
Documents and messages you send through the portal are held by Supabase in its US East region. The portal runs on Vercel, and portal emails are sent through Resend.
Can I remove your access?
Yes, at any time, from your own accounts. Each connection is an invitation you sent, so you can remove it yourself whenever you choose.
What happens when an engagement ends?
We remove ourselves from each of your accounts. Client records are kept for 7 years after our engagement ends, unless your engagement letter states a different period.
Tell us what you sell and where. Get a written quote.
Tell us what you need in the form below. We reply by email within 1 business day, and your written quote lists each service in USD and the PKR total.
Get a written quoteYou pay only after you accept a written quote.