Share the books without handing over the keys
Scoped read-only share links that render every report from the same registry the app uses, plus scoped viewer users who navigate the application itself with writes disabled and the fence enforced per endpoint.
Every organization on Zeno has someone who needs to see the numbers and should not have a login: an investor, a lender, a silent partner, an outside CPA, a family member on the deed. The usual answer is to export a PDF every month and email it, which is stale on arrival and untraceable the moment it’s forwarded.
There are two ways to give someone read access now, and both run on the same permission code.
A share link, scoped
Generate a read-only link scoped to whichever companies, reports, and date ranges you choose. The recipient opens a viewer, not a PDF. They can move the dates, filter and sort the general ledger, switch companies if the link allows more than one, search transactions, and export what they’re looking at.
Every report renders from the same registry the application uses, so a share link doesn’t lag the app by a release. A bill opens as a bill rather than as a journal entry. An invoice shows the invoice behind the number, with its receipts. Vendor and customer pages are the same party pages you see inside Zeno, carrying buyer and tenant context where it exists. The chart of accounts groups and indents the way it does in the app. A quick view opens a record without leaving the report, scoped to the link, so a share that excludes payables can’t be walked into payables through a link on a row.
Or a viewer user, in read-only
For someone who needs this often, a scoped viewer user logs into the application and navigates the books, with every write disabled and every module they weren’t granted closed off. The fence is enforced per endpoint and pinned from the route source, so a route added next month is denied by default. A scoped manager is read-only too: the scope wins over the role.
Serving files honestly
Two security items shipped alongside. A shared attachment is served as the content type it actually is rather than the one its filename claims, so a file can’t present itself as something else in the recipient’s browser. And we closed an unauthenticated proxy path to cloud files that predated all of this.
Mail moves to Postmark
Resend is decommissioned. Receipts, invoices, document requests, statement runs, and notifications all go through Postmark, on your own sending domain if you’ve configured one.
Documentation for both, for readers and for engineers, is in the help center. [email protected].