Security at AccountingQB

Your QuickBooks data is never stored

In both modes, we never store your books. We do not keep, log, or analyze your transactions, amounts, account balances, invoices, or your customer and vendor information. On the local tier that data never even reaches us; on the hosted connector it transits per-request with zero retention. The only thing the hosted service holds on your behalf is your QuickBooks OAuth token — encrypted at rest (see below) — so it can act for you when you ask it to.

OAuth tokens & encryption

On the hosted connector, your QuickBooks access and refresh tokens are encrypted at rest with AES-256-GCM authenticated encryption — a unique random initialization vector per value and an authentication tag verified on every decrypt. The encryption key is a managed secret held outside the database; tokens are encrypted on write and decrypted only in memory to fulfill your request. On the local tier, the refresh token is encrypted with Fernet and restricted to owner-only file permissions.

Connecting uses OAuth 2.1. Refresh tokens rotate on every use, and if a revoked refresh token is ever replayed, the entire token lineage is invalidated — automatic detection of token theft.

Authentication & access control

Every hosted-connector request must carry a short-lived, audience-bound bearer token (signed JWT); requests without a valid token are rejected, and the service fails closed if its signing secret is absent. The connector also validates the request host against an explicit allow-list (protection against DNS-rebinding). Redirect URIs in the OAuth flow must be HTTPS. Our web app and dashboard are authenticated with Clerk, and administrative pages are restricted to accounts with an explicit admin role.

What we collect — full transparency

We collect the minimum needed to run the service. Concretely:

• Account & billing: your email, and your license key, tier, and status. Payments are handled by Stripe — we never store card numbers.
• Usage metadata (licensed deployments): when your install is tied to a license key, each tool run records the tool’s name, your QuickBooks company ID (an opaque identifier), an estimated time-saved value, and a timestamp — this powers your dashboard. It contains no financial content — no amounts, transactions, names, or balances.
• Local, no license key → no telemetry: if you run locally without a license key configured, no usage data is sent anywhere.

We also keep operational event logs for connection events (connect, token refresh, disconnect). These are sanitized before storage — tokens, secrets, and credentials are automatically redacted.

Transport & infrastructure

All traffic is over HTTPS/TLS; the connector forces HTTPS. Our web responses set HTTP Strict-Transport-Security (2 years, including subdomains, preload-eligible), a Content-Security-Policy of frame-ancestors 'none', X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a strict Referrer-Policy, and a Permissions-Policy that denies camera, microphone, and geolocation. Sensitive endpoints (token, OAuth, and checkout) are rate-limited. Secrets are held in a dedicated secrets manager and are never committed to source control; our CI actions are pinned to specific commit revisions.

We build on established providers: Vercel (web & API), Fly.io (the hosted connector), Supabase/Postgres (licenses and encrypted tokens), Stripe (payments), and Clerk (authentication). None of these has access to your QuickBooks financial data.

Your control

You can disconnect a QuickBooks company at any time. When you do, we delete its token from our database and revoke it with Intuit. You can request deletion of your account data at any time. Account and license data is retained for the duration of your subscription plus 90 days after cancellation.

Report a vulnerability

Found something? We want to hear from you. Email support@vasperacapital.com and we’ll respond promptly. Please give us a reasonable window to remediate before any public disclosure.

This page describes the product as built. For how we handle personal data, see our Privacy Policy; for terms of use, see our Terms of Service.