Aolog アオログ — Where your data lives

Internal note for What Else Labs. Aolog is an internal, invite-only bookkeeping tool — not a public product. This describes what the tool stores and where, so the team knows how the company's financial and personal data is handled. It is a working reference, not a legal document.

Who can use it

Access is invite-only. Public sign-up is off; an admin adds each user. Every user sees only their own ledger — data is isolated per account and reachable only by that authenticated user.

What it stores

• Account: email, name, and a salted PBKDF2 password hash (never the plaintext password). If Google sign-in is used, the Google account id, email, and display name instead of a password.
• Filing profile: 氏名・屋号・業種・住所・電話・生年月日・納税地の税務署・登録番号. No マイナンバー (My Number) is stored — it is entered by hand on the final form.
• Bookkeeping: transactions (date, amount, category, 摘要, 取引先, free-text notes) and the append-only audit trail that keeps prior versions.
• Invoices: customer name and address (third-party personal data about clients) and line items.
• Receipt files: the images/PDFs uploaded — these can contain names, addresses, and other details, stored as-is.
• Passkeys: only a credential id and public key. Biometrics (fingerprint/face) never leave the device.
• Operational: IP address is used transiently for rate-limiting only (held for the rate-limit window, then swept). No analytics, no third-party trackers.

Where it lives & who processes it

• Cloudflare — Workers, database (D1), and receipt storage (R2). Encrypted in transit (TLS) and at rest.
• Cloudflare Workers AI — receipt images are read by an OCR model (stays on Cloudflare).
• Google — only if Google sign-in is used (identity).
• Resend — only if email is enabled: invite links and the off-site backup copy (the backup is AES-256-GCM encrypted when BACKUP_ENC_KEY is set).

Backups & retention

Statutory books (帳簿) are kept 10 years per 電子帳簿保存法. A full database backup is written to R2 nightly, versioned by date and never overwritten, with an optional encrypted off-Cloudflare copy. Deleting an account erases that user's rows and receipt files.

Third-party personal data

Because Aolog holds personal data about clients (invoice recipients) and vendors (on receipts), handling it is an APPI (個人情報保護法) responsibility of What Else Labs as the operating company — kept accurate, access-controlled, and retained only as long as needed for bookkeeping and statutory obligations.