Security
Last updated: July 15, 2026
OAuth-only access
We connect to QuickBooks Online exclusively through Intuit's official OAuth 2.0 flow. We never see or store your QuickBooks login credentials.
Encryption in transit and at rest
All traffic is encrypted with TLS 1.2+. Access tokens and sensitive fields are encrypted at rest using industry-standard algorithms.
Isolated, monitored infrastructure
Application and database infrastructure run in isolated environments with automated backups, access logging, and error monitoring.
Least-privilege access
Internal access to production data is limited to what's required for support and operations, and is logged and reviewed regularly.
Authentication
Account access is protected with password hashing (bcrypt or equivalent), and we support single sign-on through Google and Microsoft. Session tokens are short-lived and stored in secure, HTTP-only cookies.
Application security
We follow standard web application security practices, including protections against SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), and a Content Security Policy on all pages. Dependencies are monitored for known vulnerabilities.
Reporting a vulnerability
If you believe you’ve found a security vulnerability, please report it to [email protected] rather than filing a public issue. We aim to acknowledge reports within two business days.