If we disappear tomorrow, you lose nothing.
That sentence is RE’s entire data policy. Everything on this page is just the engineering that makes it true.
Open any of it in a text editor. It reads like what it is.
The design
Boring choices, made for you.
Files, not a database
Your books are pretty-printed, human-readable files — one per year — written atomically so a power cut can’t half-save them. Grep them, git them, back them up with anything that copies files.
No bank credentials, ever
RE never asks for your bank login because it never connects to your bank. You download a statement; you give it to RE. There is no token to leak, no feed to break, no aggregator in the middle.
Nothing leaves your server
Self-hosted RE makes no calls home. No analytics beacon, no telemetry, no “sync.” The only people who can read your books are the ones you gave a login.
Locked means locked
Closed months refuse edits. Every meaningful action — who entered, changed, voided, reconciled — lands in an append-only audit trail inside the book itself, where it travels with your data.
Access has three sizes
Admin, editor, viewer. The treasurer edits, the board reads, and nobody needs our permission — accounts live in your files, hashed with bcrypt, rate-limited at the door.
A published schema
The file format is documented and stable. Any future tool — ours, yours, or a stranger’s — can read your books. Lock-in isn’t a business model here; it’s a bug we refuse to ship.
“12,000 businesses learned in one December morning that their books belonged to their bookkeeper. Ownership isn’t a feature. It’s where you keep the files.”
On the Bench shutdown, December 2024
Questions, answered plainly
The FAQ.
Where exactly do my books live?
In a data/ folder on whatever machine runs RE — your shared-hosting account, a $3 VPS, an old laptop, a Raspberry Pi. The folder sits outside the web root, so nothing in it is ever directly downloadable from the internet. Copy that folder and you have copied your books, receipts and audit trail, completely.
What happens if GRESS shuts down?
Your installation keeps running — it never depended on us being alive. Your files stay readable in any text editor, and the published schema means other software can import them. The worst case of our failure is that you stop getting updates. Compare that with the worst case of a cloud bookkeeper’s failure, which 12,000 Bench customers can describe.
Is my bank account safe?
RE never has your bank credentials, so it cannot lose them. The only bank data RE ever sees is the statement you choose to give it — the same document you’d hand an accountant. That is the entire attack surface, and it is yours to control.
Can my accountant work with this?
Yes — happily so. Underneath the simple interface is a real double-entry ledger: trial balance, general ledger export, receipts attached to entries, and locked reconciled months. Give them a viewer login or the year-end export; either way they get books that were closed to the penny every month, which is more than most small clients bring them.
What about backups?
Anything that copies files backs up RE — your host’s snapshots, a cron job, a sync folder, a USB stick. One folder, copied anywhere, is a complete backup. The app also makes a one-click zip of everything. We recommend the treasurer’s classic: monthly backup right after the close, kept somewhere that isn’t the server.
Handing off to the next treasurer?
Give them a login and step down — or hand over the whole folder. Either way they inherit every closed month, every receipt, and the audit trail of everything you did. The handoff that usually takes a shoebox and three phone calls becomes a folder and a password reset.
Get started
Books you could walk away with.
That you’ll never need to is the point.