Only the right people, and a record of everyone
One board year, and what the books remember of it
A new board is elected in May
A treasurer, a president, a secretary, two vice presidents, and whoever chairs the fall festival. Six people who need six different amounts of access to the same set of books.
You invite each one with the role they need
By name and email, at admin, editor, viewer or reviewer. A reviewer is not a weaker viewer: they see only the items they were personally asked to sign, with no ledger, no reports and no chart of accounts. That is how a president approves a check without being handed the books.
They work through the year
Entries, reconciliations, expense reports, checks. Nobody can hand themselves more access than they were given, and nobody can change their own — the role you hold is the role somebody else put you in.
Every change writes down who and when
Expense reports, checks, journal entries, individual lines, vendors and reconciliations keep an append-only history. Nothing in the application can edit or delete one of those rows. The name is stamped on at the time, so it still reads correctly after that person leaves in July.
The bank connection only ever reads
BeeKeeper asks your bank for two things: balances and transactions. There is no permission to move money, because there is no feature that moves money. A connection that goes quiet for thirty days is flagged rather than silently forgotten.
The numbers that must not leak do not
A vendor's EIN or SSN is encrypted in the database, and the change log keeps an allowlist of fields specifically so an encrypted number can never be written into it in plain text. Review links are thirty-two random characters, stored only as a hash, and dead after seven days.
When support has to fix something, the log says we did it
A duplicated import, a check that will not void. The correction is written as FutureFund Support, with the name of the person who approved it and the ticket number beside it. It is never written as you. An audit trail that makes your own history claim you did something you did not do is the one thing it must never do.
A year later, it still answers the question
The audit committee asks why that check was voided in March. The record says who, when, and why — not because anybody remembered to write it down, but because there was never a way not to.
The risk to a PTA's books is almost never a hacker.
The president, last year's treasurer, whoever set it up, and one email address nobody at the table can identify.
Asking a busy parent to sign off on one check should not mean handing them the general ledger.
The amount is not what you remember it being. There is no other version of the truth to check it against.
Four roles, and one of them is not a weaker version of the others
The whole application, plus the things only a treasurer or president should touch: who else has access, the bank connections, and closing the fiscal year.
Works the books day to day — entries, reconciliation, expenses, checks. Cannot change who has access.
Reads, and nothing more. Deliberately left out of the operational email too: a read-only role does not need the queue in their inbox.
Sees only the items they were personally asked to sign. No ledger, no reports, no chart of accounts. It exists so a president can approve an expense without being handed the books.
PTA accounting that runs itself
Built for school groups. Free for 30 days, no credit card required.
What is protected, and how
BeeKeeper asks your bank for two things: balances and transactions. There is no permission to move money, because there is no feature that moves money.
A vendor's EIN or SSN is encrypted in the database. The change log records an allowlist of fields specifically so an encrypted number can never be written into it in plain text.
Expense reports, checks, journal entries, individual lines, vendors and reconciliations keep a record the application cannot edit or delete.
Accounts, budgets, permissions, reconciliations, fiscal year closes, vendors and more keep a full version history, so what a number used to be is always answerable.
A review link is thirty-two random characters and only a hash of it is stored, so a copy of our database could not be used to manufacture a signature. Each one dies after seven days.
Requests from outside the United States and Canada are refused before they reach the application. Hosting is Google Cloud, behind Cloud Armor.
The part most software does not put on a page
And so much more
Frequently Asked Questions
Keep looking around
Sign-Off
Your bylaws require two signatures. Sign-Off collects them by email, on a phone, with no login — and writes down who approved what, and when.
Budgets & Amendments
Build the annual budget, take it from working draft to proposed to approved, and track actuals against it all year. Amendments are numbered, carry their reason, and stay on the record.
Check Printing
Print one check or a whole run on plain check stock, with alignment you calibrate once. Voids, reprints and check numbers are all tracked for you.