Clear distinctions: native processing without AI, local archiving and revocable AI modules.
For complete transparency, we clearly distinguish how accounting calculations run, where data is hosted, and how optional AI works.
Deterministic execution on Voilà servers
Voilà is a cloud web application (SaaS). All accounting, tax (GST/QST) and PDF calculations run in native PHP/SQL code on our secure servers, with no transfer to external AI providers.
Keep your documents locally
Generate and keep PDF invoices, tax reports and exported accounting journals on your computer without depending on a locked proprietary format.
Explicit activation per module
AI features, such as assisted expense OCR import, are disabled by default. If enabled, only documents submitted to that module are analysed; permission can be revoked at any time.
Methodology, control scope and assessment dates
The Fast4u SaaS Web Shield score (100 / 100) reflects the active public certificate for voila.fast4u.co and our internal checklist for the application scope below (last reassessed: October 23, 2026):
| Area checked | Scope & Mechanism | Verification method | Validation date |
|---|---|---|---|
| Transport & Encryption | TLS 1.3 (strict HTTPS) in transit and AES-256 at rest for secrets and tokens. | Server configuration & OpenSSL inspection | 23 oct. 2026 |
| HTTP / PHP2Shell shield | ProtectAgainstPhp2Shell middleware, php.ini hardening and upload filtering (CVE-2026-109618). | Internal application penetration tests & code review | 21 oct. 2026 |
| Strong Authentication | Laravel Fortify 2FA (TOTP), WebAuthn security keys / Passkeys and rate limiting. | Authentication feature test suite | 23 oct. 2026 |
| Card Payments | Payments handled by Stripe (PCI-DSS Level 1 certified); Voilà stores no full card numbers. | Stripe SDK / Webhook flow audit | 23 oct. 2026 |
Security and compliance: rigorous, verifiable and transparent protection.
Every technical and contractual layer of Voilà is engineered to safeguard the integrity of your accounting records, your clients' privacy and your digital sovereignty across Quebec, Canada and internationally.
Against critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), Voilà deploys a 4-tier defensive shield: pre-request neutralization of session.upload_progress and fatal_error_backtraces (.htaccess / .user.ini), WAF filtering of multipart/form-data boundaries and CGI injections prior to application boot, anti-OOM longjmp() memory capping, and hardened HTTP headers.
Encrypted transmissions, protected secrets and strong authentication
All communications are protected in transit by TLS 1.3 encryption and sensitive application secrets (SMTP credentials, tokens and integration keys) are encrypted with AES-256. Each business account operates within a strictly isolated logical perimeter with CSRF protection, two-factor authentication (2FA) and passwordless Passkeys.
Governance aligned with Quebec Law 25 and federal PIPEDA
Analytics cookies remain disabled by default until your explicit consent. You retain full control at all times to withdraw consent, export, rectify or delete your data, supported by our official policies published in six languages.
Stripe PCI-DSS payment infrastructure and AI disabled by default
Card payments are processed through Stripe's PCI-DSS certified infrastructure without storing card numbers on Voilà servers. Likewise, our AI assistance plugins are locked by default upon account creation and only activate by your explicit choice.
Receipt traceability and structured tax preparation
Controlled sequential numbering, full preservation of multi-page PDF receipts, accurate breakdown of Canadian taxes (GST, QST, HST, PST) and input tax credits (ITC/ITR), and preparatory T2125 / TP-80 statements ready for your accountant's review.
Transparency and professional responsibility notice: Voilà implements technical and contractual controls aligned with Quebec Law 25 and federal PIPEDA. The platform automates bookkeeping and document preparation, while final tax and accounting validation remains the responsibility of the business or its chartered professional accountant.
Voilà's Immediate Response to the Critical Vulnerability Threatening 70% of Websites
Within just a few hours of the major alert published in La Presse on October 21, 2026 regarding critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), the Informatique Fast4u engineering team designed, verified, and deployed a comprehensive 4-layer protection shield across the entire Voilà infrastructure.
“Upheaval on the Internet: A Critical Security Flaw Threatens 70% of Websites”
The article details the global shockwave caused by two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2/10) discovered at the core of the PHP language, exposing unprotected servers to automated attacks.
Emergency Response Timeline (within just a few hours)
Publication of the alert on critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 affecting 70% of websites.
Attack vector analysis: longjmp() (OOM) memory corruption, multipart/form-data boundaries, and session.upload_progress.
Activation of pre-request hardening (.user.ini / .htaccess), Apache WAF rules, and the Php2ShellShield pre-boot guard.
Verification of the 2026.10.21-PHP2SHELL-SHIELD header and transparent publication of the patch report.
Technical Report of the 4 Immediate Patches Deployed on Voilà
Active protection with zero downtimePre-request neutralization of session.upload_progress and fatal_error_backtraces
Strict deactivation in .user.ini and .htaccess (mod_php, PHP-FPM, and CloudLinux lsapi) of session.upload_progress.enabled = 0, fatal_error_backtraces = 0, and zend.exception_ignore_args = 1 prior to HTTP body parsing, blocking global session state corruption at the source.
WAF filtering of multipart/form-data boundaries and anti-OOM longjmp() capping
Apache mod_rewrite rules immediately rejecting with 403 Forbidden any request containing multiple boundary= declarations, a multipart boundary exceeding 70 characters, or the PHP_SESSION_UPLOAD_PROGRESS parameter, combined with caps on max_input_vars (2000) and max_input_nesting_level (32).
Upstream inspection in public/index.php prior to framework loading
Instant verification of multipart boundary RFC compliance, rejection of payloads exceeding 32 MB, blocking of CGI argument injections (-d, %AD, allow_url_include, auto_prepend_file) and phar:// / expect:// / php://filter streams, and immediate deletion of any suspicious temporary file.
ProtectAgainstPhp2Shell Middleware and server signature removal
Dual application-level validation at the top of the Laravel middleware stack, removal of the X-Powered-By header, blocking of direct access to .user.ini / .env / .git / .htaccess files, and addition of the X-Voila-Security-Shield: 2026.10.21-PHP2SHELL-SHIELD audit header.