What is encrypted, and why

A company file is one .acbo file on your disk, and it holds everything: customers, employees with their pay and bank details, every transaction. From the first release after the 0.1.0 beta, that file is encrypted on disk with AES-256 (SQLCipher), using a password you choose when the company is created. Someone who copies the file from a stolen laptop, a USB stick or a cloud folder gets nothing readable without the password. Nothing is uploaded; the encryption happens on your PC, and the file still opens only in AcboBooks.

Two passwords, not one

	File password	User password
Protects	The file on disk	Who can do what inside the open file
Asked	When a PC opens the file for the first time	Every time someone signs in
One per	Company file	Person (administrator, standard, view only)
Set in	Company Settings → File security	Company → Users

The file password is shared by everyone who opens that file on their own PC; the user password is personal. A bookkeeper with the file password but no user account still cannot sign in. See users and roles.

Where the password is remembered

When you open a protected file and leave Remember on this computer ticked, AcboBooks stores the password in your Windows user profile, sealed by Windows itself (the same mechanism that protects saved browser passwords). From then on the file opens without asking on that PC and for that Windows user only. Another PC, or another Windows account on the same PC, asks for the password once and then remembers it too.

If you would rather be asked every time, for example on a shared office PC, turn on Ask for the password on every open in Company Settings → File security, or click Forget on this computer.

The recovery key and the .recovery file

Whenever a file password is set or changed, AcboBooks shows a recovery key: 40 letters and digits in eight groups. It is shown once. It is not the password; it is a second way to open the file if the password is forgotten, and it works together with a small file named Your Company.acbo.recovery that is saved beside the company file. Either one alone opens nothing, which is why the key is safe to print and file away from the computer.

Print the key or save it in a password manager, and tick I have saved this recovery key only when you have.
Do not keep it only on the same PC as the file.
Leave the .recovery file where it is. Backups made by AcboBooks copy it along with the company file.

Using the key: on the password prompt click I forgot my password, enter the key, and the file opens. You are then asked to choose a new password, which produces a new recovery key; the old key stops working.

Opening the file on another PC

Copy the .acbo file (and its .recovery file) to the other PC, or restore a backup there, and open it. That PC asks for the file password once. For two people working at the same time, do not copy the file; use multi-user hosting, where only the host PC holds the file and the others connect over the network. Connecting clients never need the file password.

Changing or forgetting the password

Company Settings → File security (administrator only):

Change file password… asks for the current password and the new one, re-encrypts the file in place, and shows a new recovery key. Every other PC that had the old password remembered will ask for the new one at its next open.
Ask for the password on every open stops this PC from opening the file silently.
Forget on this computer removes the remembered password from this PC only.

Choose at least 8 characters. A short sentence you will remember beats a complicated word you will not.

Files made before encryption

A company file created by an earlier version is a plain file, readable by anyone who copies it. When an administrator opens one, AcboBooks offers Protect this company file: choose a password and the file is encrypted in place in a few seconds, with a recovery key shown as above. Not now leaves it as it is; the offer returns next time, and the same conversion is always available under Company Settings → File security.

If the password is lost

Another PC remembers it. If any PC in the office still opens the file silently, open Company Settings → File security there and change the password; you do not need the old one on that PC.
The recovery key. Click I forgot my password on the password prompt and enter the key (the .recovery file must be beside the company file).
Licensed customers: ask us. When a licensed copy of AcboBooks sets a file password, it also sends us a sealed copy that only our offline key can open, tied to your licence. Email [email protected] from the address on your licence with the company name exactly as it appears in the app. We verify it is you, open the sealed copy, send the password back, and record the recovery in our audit log. Change the password afterwards. Trial copies do not send the sealed copy, so for a trial the recovery key is the only way back.

If none of the three applies, the file cannot be opened by anyone, including us. The options are then a backup made before the password was set, or a new company with the lists and balances re-entered. Keeping the recovery key is cheap insurance.

Backups and the recovery file

Backups made by AcboBooks (automatic, Back up now, and the copies taken before an import or year-end close) are encrypted exactly like the working file and carry the .recovery file with them. They open with the same password and the same recovery key. An encrypted backup for sending (the .enc file) is different: it has its own password, chosen when you export it, with no recovery at all. See company file and backups.

The file password, the recovery key, and what to do if you lose them