Security · stated plainly

The controls, as built. And what is not done yet.

BookSyncHQ is trusted with read access to other people’s books, and its whole claim is that a stranger can check its work. So this page says what the code does, not what a badge would imply — and it lists what we have not done, starting with the fact that no SOC 2 report exists.

S1 · Ledger access

Read-only, enforced where it can be seen.

No writes, by rule: No request BookSyncHQ makes to a QuickBooks or Xero API host is anything but a GET, apart from the OAuth token and revocation calls. The rule is checked by searching the code, and a tie-out that finds a break tells you where to correct it rather than correcting it.
Scopes: Xero is granted granular read-only scopes. QuickBooks Online offers no read-only accounting scope, which is exactly why the GET-only rule lives in our code rather than in the grant.
Credentials: Access and refresh tokens are encrypted with AES-256-GCM under a key held only in the server environment, refreshed server-side before they lapse, and never sent to the browser, written into a URL, or logged.
Disconnect: Disconnecting at /connect revokes the grant at Intuit or Xero and deletes the stored tokens. If the provider does not confirm the revocation, the page says so and tells you where to remove the app yourself.

S2 · Arithmetic and evidence

Deterministic arithmetic, and a record that shows if it was changed.

Integer cents: Money is parsed to integer cents and compared for exact equality. Floating point never compares money, and nothing is rounded away: a difference of a cent is a finding.
Evidence chain: Every run, finding, resolution, approval, certificate and disconnect is appended to a per-client record whose hash covers the previous record’s hash. Editing, deleting, reordering or truncating any record breaks the chain from that record onward, and the break is reported by sequence number.
Certificates: A certificate’s body is canonical JSON — what was compared, the SHA-256 of each input, when, the result, the resolutions and who approved them — hashed with SHA-256 and anchored by an RFC 3161 timestamp from DigiCert’s public authority. If the timestamp authority is unreachable, the certificate says “no timestamp” rather than pretending.
Anyone can verify: The public page at /verify recomputes the body hash, checks the certificate’s place in the chain and shows the timestamp token; the token also verifies offline with openssl ts -verify. See the specimen.
What that is not: Tamper-evident is not tamper-impossible. An operator with database access could rewrite a record; the timestamp is what makes that detectable for anything certified. A certificate is not an opinion on the financial statements.

S3 · Data

Processed transiently, stored encrypted, deleted on your schedule.

Processing: Where an AI-assisted feature is used, the minimum excerpt is processed under Anthropic’s commercial API terms: not used for training, deleted by the provider within 30 days. AI never changes a result — tie-outs are arithmetic.
No training: BookSyncHQ does not train models on anyone’s books. Xero’s API terms prohibit using API data to train AI or ML models on every tier (verified September 23, 2026); we treat QuickBooks data the same way.
Storage: Tie-out results and evidence are stored encrypted in a managed PostgreSQL database in the United States and deleted on the schedule you set. The free tie-out at /check computes in your browser.
Subprocessors: Vercel Inc. — Application hosting, serverless compute, and content delivery. United States; always.
Supabase Inc. — Managed PostgreSQL database for accounts, connections, and verification records (hosted on AWS, us-east-1). United States; always.
Anthropic, PBC — AI model processing for features that use it (for example, drafting a plain-language explanation of an exception). United States; only when you use an ai-assisted feature.
Stripe, Inc. — Payment processing and invoicing. United States; only when you purchase.
Cloudflare, Inc. — DNS for booksynchq.com, and routing of email sent to booksynchq.com addresses into our intake system (hosted on Vercel and Supabase). United States; dns always; email only when you write to us.

S4 · The application

Sessions, isolation and the headers every page carries.

Sign-in: Design partners sign in with an invite code that sets a signed, httpOnly session cookie for thirty days. There is no password to phish.
Isolation: Every authenticated request is scoped to the signed-in firm through the client’s owner; another firm’s object answers as not found, never as forbidden, so ids reveal nothing.
Headers: HSTS with preload, frame-ancestors none and X-Frame-Options DENY, nosniff, no referrer, and a Permissions-Policy that denies camera, microphone and location. API responses are never cached.
Inputs: Uploads are capped in size and rows and parsed as data; account and file names render as text, never markup; exported CSVs neutralize formula prefixes.

S5 · Not done yet

What we have not done, so you do not have to ask.

Not yetSOC 2: No SOC 2 report exists. We will not describe BookSyncHQ as SOC 2 anything until one does.
Not yetPenetration test: We have not published a third-party penetration test.
Not yetSSO and MFA: Sign-in is by invite code during the design-partner program; single sign-on and multi-factor sign-in come with general accounts.
Not yetData residency: Data is hosted in the United States only; there is no EU or other regional option.

S6 · Reporting

Found something? Tell us first.

Write to partners@booksynchq.com with the details and how to reproduce it, and please do not access data that is not yours while you look. Privacy practices are in the privacy policy; the service terms are in the terms.