Why you can believe these books

A ledger that cannot quietly change.

Accounting software usually asks you to trust the company. ThumaBooks is built so you don't have to: the ledger's own structure makes silent edits impossible, every hand in the books is named, and the complete record is yours to take away at any moment — which keeps us honest in the only way that counts.

The chain, illustrated Append-only

// each entry seals the one before it
entry 8041 hash 3f9c…a1 prev 77d2…0e
entry 8042 hash b62e…54 prev 3f9c…a1
entry 8043 hash 08aa…c7 prev b62e…54
// edit 8042 and every hash after it breaks
verify: chain intact, 8,043 entries

Every posted entry carries a cryptographic hash of the entry before it. Change one number in the past and the chain visibly breaks from that point forward — for us exactly as for anyone else.

Five mechanisms

Trust built out of structure, not promises

Entries are never edited

The ledger is append-only. A posted entry is stored exactly as recorded and is not altered afterwards — by you, by us, or by a bug with good intentions. A correction is a new entry that names what it corrects, so the history of a mistake stays readable. That is how an auditor wants your books to behave, and how very little small-business software actually does.

Each entry seals the one before it

Every entry carries a cryptographic hash of its predecessor. The chain makes tampering loud: rewrite anything in the past and every entry after it stops verifying. You can check the integrity of your own books from inside the product, whenever you like, without asking us.

Every entry knows where it came from

An entry records its source permanently — the photographed receipt, the bank statement line, the sale rung up, the person who approved it. Your settings show which entries arose from your approval and which were derived from transactions the Thuma network already processed for you.

The door has a log

Access is by named person and named role — who may read, capture documents, approve entries, change the chart of accounts or close a period. Adding someone and removing someone are both recorded in an append-only access log, so "who could touch the books in March?" has an answer nobody can tidy up afterwards.

Leaving is easy, on purpose

One tap exports your complete books in machine-readable form, free, on every plan, without notice to us. Software you can always walk out of has to keep deserving you — that is the point. And if your subscription lapses, the books go read-only rather than away.

Even the silences are signed

Honesty in the details

Money is shown as money

The watchdog and the reports speak in dollars and cents, not percentages — "you lost $23 on cooking oil", never "margin variance of 8.2%".

A muted warning stays visible

Mute a watchdog check and the mute itself is shown, with the name of the person who muted it. Nobody can make the software quietly stop looking.

Absent means absent

If a figure isn't known, the product says so instead of showing a zero that looks like knowledge. A blank you can trust beats a number you can't.

Refusals name the door that opens

When the product refuses something — a backdated edit into a closed month, a void of a fiscalised invoice — it tells you what to do instead, in a sentence, in your language.

What we do not warrant, said plainly: document reading and proposed entries can be wrong, which is why an entry posts only when a person approves it, or when a rule a person wrote and switched on applies — and the entry names which. What we do warrant: entries recorded in your books are stored exactly as recorded and never silently altered. The distinction is the whole product.

Books worth showing a bank

Gapless invoice numbers, a chained ledger, a signed audit trail — from your first sale onwards, without hiring anyone.

See what it does