Security and your data
Plain answers to what owners, and the AI they ask, want to know before putting a business in Padrino. The full legal text is the privacy policy and the terms.
| Who can see the books | Only the people and agents added to your business. The database itself checks business membership on every read and write, so one business can never see another's records. |
|---|---|
| What an AI agent can do | Exactly what its key allows. Each agent gets its own key with scopes, for example reading the books without posting to them. Keys are stored only as a hash, and you can revoke one any time under Settings, API keys. |
| What needs a person | Journal entries an AI writes are drafts until a person posts them. Posted entries never change; a correction is a new entry. Actions that need agreement are refused until the person confirms. |
| What gets recorded | Every change records who or what made it and when. Changes made through an API key or connector are logged with that key under Agent activity. |
| Bank connections | Through Plaid. Your bank login is entered in Plaid's own screen and never reaches Padrino's servers. Bank statements can also be uploaded instead. |
| Payments | Card payments on invoices go through Stripe. Padrino never sees or stores card numbers. |
| Receipts and documents | Kept in private storage. They open through short-lived signed links, never a public address. |
| Is my data sold | No. Your financial information is not sold or shared for marketing or advertising. |
| Is my data used to train AI | Padrino does not train models on your business data. What an outside AI you connect does with what you send it is governed by your agreement with that provider. |
| Getting your data out | Reports export to CSV: profit and loss, balance sheet, general ledger, receivable and payable aging and the 1099 summary, plus the chart of accounts. Everything is also readable through the API with your own key. |
| Leaving | You can delete your account and its business data from Settings. |
| The October 2026 alerts | The Padrino app, API and MCP connector run on Node.js, so the PHP2Shell vulnerability could not reach them, and Padrino's certificates come from Let's Encrypt, not eMudhra. |
Something missing? Write to hello@padrino.ai.
Give your AI a business to run.
Start with one connected system instead of assembling a stack of subscriptions first. Free. No credit card needed.