Everything your books
need. Nothing they don't.
Nine feature groups on one ledger. Everything listed here works today. Where something is prepared but not sent to an authority, it says so. Practice-tool status lives on For accountants.
A signed receipt for every posted entry.
Every journal entry posted to the ledger is debited, credited, and given an Ed25519-signed receipt linked into a SHA-256 hash chain. Drafts, bank lines and imports are receipted when they are posted. The third entry is a receipt you can verify.
Balances and entries live in PostgreSQL with row-level security. One source of truth, built for audit.
Ed25519-signed and linked to the previous receipt by SHA-256. Verify one receipt, or the whole chain, from the Triple-entry page.
Each receipt carries the hash of the one before it, so a later change to any receipt is detectable. It is a linear hash chain, not a Merkle tree.
Posting, voiding, reversing, un-posting, deleting, period locks and account changes are recorded. Not every module records every action yet.
A posted entry is undone by a new entry that references it. History is not rewritten.
Lock or close a period to stop new postings into it.
Ask. Review. Approve.
Bella is an assistant inside your ledger. Ask in plain English; she reads your books, drafts entries, invoices and returns, and asks for your approval before anything changes. She works while you are using Airtight, not overnight. Switch her to Guarded or Off at any time.
Ask "what is overdue?" or "why is gross margin down?" She answers from your ledger, with the numbers.
Changes appear as approval cards. Nothing posts, sends or deletes until you approve it.
Ask her to suggest matches for unreconciled bank lines. A background auto-match sweep runs for organisations that have it enabled.
The interface works in English and Arabic, with right-to-left layout.
Run a scan on demand to flag duplicate invoices and unusual amounts in plain English.
Choose how much Bella may do. Customer-facing sends and deletes are always proposed for your approval.
Import statements. Connect feeds where enabled.
Bring bank lines in by file, or connect Australian banks through open banking where it is enabled for your organisation. Then match payments to invoices and bills.
Import statements from Australian and New Zealand banks. Duplicate lines are skipped.
Connect through Basiq where it is enabled. Availability depends on our provider access.
Customers pay invoices by card. The payment is recorded against the invoice when Stripe confirms it.
Match bank lines to invoices, bills and journals, with ranked suggestions and an auto-match sweep.
Categorise bank lines by description, amount or type. Preview a rule against recent bank lines before it applies.
Compare the bank balance with the ledger and see the variance.
Quote, invoice, collect, reconcile.
From quote to paid invoice, with templates branded to your business. Payment links, recurring invoices and an overdue-reminder ladder are built in.
Create quotes, turn them into invoices and record payments against them.
Weekly, monthly or quarterly templates, generated on schedule.
Customers pay by card through Stripe. Other payment gateways are not available to customers yet.
Reminder, firmer reminder, final notice. You set tone and timing, and every send passes a compliance check. You can send a reminder by hand at any time; automatic sending is a per-organisation setting.
Invoice in the customer's currency.
Prepare ZATCA, Bahrain NBR, Oman Fawtara and UAE Peppol e-invoices from an invoice. Airtight signs and stores them but does not send them to the authority.
AU pay runs, payslips and super files.
Australian pay runs with PAYG withholding and super, payslips by email, an ABA bank file for payment and SAFF super files. STP events are recorded in Airtight; you report them to the ATO through your STP-enabled software or agent. GCC employees have separate end-of-service and WPS tools; a full GCC pay run is not built yet.
Base pay, overtime from approved timesheets, PAYG withholding on the resident scale (including HELP) and super.
Generated when a run is processed and emailed, with the delivery status recorded.
Build an ABA direct-entry file from a pay run. Airtight does not pay anyone: you upload the file to your bank.
Build SAFF super batches for your clearing house. Airtight does not send them.
Pay and update events are recorded. They are not lodged with the ATO: report them yourself.
End-of-service calculations and WPS file generation for GCC employees. Not a full GCC pay-run pipeline.
The pack your auditor asks for.
P&L, Balance Sheet, Cash Flow, aged receivables, inventory, project profitability and tax summaries, with export. Reports read the ledger.
P&L, balance sheet, cash flow, aged AR/AP and trial balance, by date range and consolidated across entities.
Drill from a total to the entries behind it.
Compare budgets with actuals.
Profitability by project from time, expenses and invoices.
View several entities together.
Verify the receipt chain for the whole ledger from the Triple-entry page.
Prepared in Airtight. Lodged by you or your agent.
Airtight prepares BAS, TPAR files, R&DTI claim data, SMSF and trust records and GCC returns. It does not lodge anything with the ATO, ASIC, ZATCA or any other authority: you or your registered agent do that, then record it here.
Calculate and review a BAS from the ledger. Record it as lodged after you have lodged it yourself.
Prepare the TPAR report and the ATO file. You upload the file.
Classify eligible expenditure, link evidence and prepare the Schedule data. Reviewed and lodged by your registered tax agent.
ZATCA (KSA), Bahrain NBR, Oman Fawtara and UAE Peppol. Prepared and signed locally; Airtight does not clear, report or send them.
Prepare VAT returns, UAE Corporate Tax and zakat calculations. File them with the authority yourself.
An SMSF register of members, contributions, investments and pensions, and statutory client trust accounts. No annual return.
Your data stays isolated.
Row-level security on every tenant table, passkeys first, scoped API keys, and per-organisation envelope encryption for the most sensitive fields.
Employee tax file numbers and bank details, and payment-gateway credentials, are sealed with per-organisation keys (CMK, KEK, DEK).
Postgres RLS on every tenant table. A query for another tenant's rows returns nothing.
WebAuthn passkeys first. TOTP as the fallback. No SMS.
Limit a key to specific permissions and revoke it at any time.
Every route that changes data needs an explicit permission. A route with no policy is refused.
Security-relevant events are recorded in an append-only log.
Import, connect, export.
Airtight connects to Xero for import, Stripe for card payments and Basiq for open banking where it is enabled.
Connect Xero and pull contacts, invoices, bills and bank transactions. One-way: nothing is written back to Xero.
Upload CSV exports. Journals import as drafts until you post them.
Accept card payments on invoices.
Subscribe to invoice, payment, contact, journal and reconciliation events from Settings.
Scoped API keys for the REST API, rate-limited.
Read-only tools for AI clients through the Model Context Protocol (five read tools).