Security and compliance
Your records stay on your premises, under your control.
Mojoo Office is self-hosted. The database lives on your own server, staff see only what their role allows, and every action is written to a log that shows if it has been tampered with.
Where your data lives
- Runs in Docker on your own server or NAS; nothing is held by us
- The database is reachable only by the Mojoo Office program, not from your network
- The owner can download a complete copy of the database at any time
Who can see and do what
- One login per person; fourteen permission ticks per login
- Cost prices, data downloads, bank details and system keys limited to the people you choose
- Passwords stored as bcrypt hashes; five wrong attempts lock the name for 15 minutes
- A changed or switched-off login is signed out everywhere at once
A record you can rely on
- Every form sent, log-in, refused action and download recorded with person and address
- Each entry is chained to the one before it with an HMAC-SHA256 signature, so edits and deletions show
- Alerts for log-ins from new addresses, out-of-hours downloads and bursts of deletions
- Activity kept for 400 days
Backups that are proven
- Nightly database backup, encrypted with AES-256 and kept for 30 days
- Each day the latest backup is restored into a separate test database and every table is compared with the live one
- Pass, warning or failure shown on screen, with the dashboard warning if a check is missed
UK compliance
Rules built into the everyday screens.
These features help you meet your obligations. They are not legal advice, and you remain responsible for your own compliance.
| Requirement | How Mojoo Office helps |
|---|---|
| VAT invoices (HMRC) | VAT per line and per rate, your VAT number, and gap-free invoice numbering. Credit notes can never exceed the invoice they correct. |
| Company details on paperwork (Companies Act 2006) | Company number, place of registration and registered office printed on invoices, quotes and letters. |
| Keeping records for six years | Customers with documents cannot be deleted, issued invoices cannot be removed, and closed periods are locked against change. |
| Late Payment of Commercial Debts Act 1998 | Business reminder letters calculate statutory interest and fixed compensation per invoice. |
| Pre-Action Protocol for Debt Claims | Letters before action to individuals give 30 days to respond and list the enclosures required. |
| UK GDPR and PECR | Marketing consent recorded with how and when it was given or withdrawn. Device passcodes are never printed and are wiped when a repair is collected. |
| Making Tax Digital | The nine VAT return boxes prepared for each quarter, ready to file through your MTD software. |
Shared responsibility
What we do, and what your setup does.
Because Mojoo Office runs on your equipment, some protections depend on how that equipment is set up. We help with all of these at installation.
| Area | Mojoo Office | Your setup |
|---|---|---|
| Encrypted connection (HTTPS) | Works behind your server's reverse proxy | Certificate and reverse proxy on the server |
| Off-site backup copy | Encrypted nightly backup files | Copy them to cloud storage or a USB drive kept elsewhere |
| Network access | Designed for use on your own network | Router and firewall; no direct exposure to the internet |
| Staff accounts | Permissions, lockout, activity log | One login per person; switch logins off when people leave |
Questions from your IT adviser or accountant?
We are happy to talk them through how Mojoo Office stores, protects and exports your records.