# Security: Encryption, 2FA, Roles & Audit Trail

> How TransferArc protects your data: TLS and AES-256 encryption, Argon2id sign-in with two-factor, roles, maker-checker approvals, audit trail and backups.

https://transferarc.com/security

- **Encrypted end to end**: All traffic runs over HTTPS (TLS). Platform secrets are encrypted with AES-256-GCM, and sensitive documents open only through short-lived signed links.
- **Secure sign-in**: Argon2id password hashing, short-lived session tokens, device-bound refresh and automatic lockout after repeated failed attempts.
- **Two-factor sign-in**: A one-time code as a second step at sign-in, for every user.
- **Roles & permissions**: Ready-made and custom roles, limited by branch, vehicle group or entity — and no one can grant themselves more access.
- **Maker-checker approvals**: Credit limits, rate cards, manual journals and reopening a closed period need a second person to approve.
- **Complete audit trail**: An append-only record of who did what and when. It never stores passwords or secret values.
- **Protected API**: API keys, IP allow-lists, rate limits, a sandbox and signed webhooks.
- **Backups & recovery**: Automatic encrypted backups with tested restores, so your data can always be recovered.
- **Always monitored**: Edge protection against DDoS and web attacks, with round-the-clock uptime monitoring.

## Controls in your hands

- Add, suspend or remove users in seconds
- Sign a user out of every device
- Require two-factor sign-in for everyone
- Restrict API access to your own IP addresses
- Review the audit trail at any time

## Your data, always yours

- Export bookings, ledgers and reports to CSV or PDF
- Invoices archived as PDF/A-3 with the original XML
- Financial records kept for the legal retention period
- Your customer data is never sold or shared

## Frequently asked questions.

### How does TransferArc protect my data?

All traffic runs over HTTPS (TLS). Platform secrets are encrypted with AES-256-GCM, passwords are hashed with Argon2id, and sensitive documents open only through short-lived signed links. Automatic encrypted backups with tested restores mean your data can always be recovered.

### Does TransferArc support two-factor authentication?

Yes. Every user can sign in with a one-time code as a second step, and a company can require two-factor sign-in for everyone. Accounts lock automatically after repeated failed attempts, and a user can be signed out of every device.

### What is maker-checker approval in TransferArc?

Maker-checker means a second person must approve a sensitive change. In TransferArc, credit limits, rate cards, manual journals and reopening a closed period all need a second approver, and no one can grant themselves more access. Every action is recorded in an append-only audit trail.

### Can I export my data from TransferArc?

Yes. Bookings, ledgers and reports export to CSV or PDF, and invoices are archived as PDF/A-3 with the original XML. Financial records are kept for the legal retention period, and your customer data is never sold or shared.