It depends on three things you can actually check: what the connector stores, what it is allowed to do to your books, and whether the assistant's operator trains on what it sees. Anyone answering "yes, totally safe" without addressing those three is selling. Here are ours, in order.
What is stored, and what is not
Caribooks is a relay. A question goes to QuickBooks, the answer comes back to the assistant, and nothing about your accounting is kept in between. No copy of your ledger, no cached reports, no customer or invoice list on our side.
Three things are stored, because the service cannot function otherwise:
- Your account email address.
- The names of the companies you have connected.
- Your QuickBooks access tokens, AES-256 encrypted, on infrastructure hosted in Canada (AWS Montréal region).
That is the whole list. Do not read it as "nothing worth stealing", though. The tokens are the sensitive part: whoever holds one can read the books it is bound to until it is revoked. That is why they are encrypted, and why revocation matters more than any other control on this page.
A token, not a password
We never receive your QuickBooks password. Authorization happens on Intuit's own screen, the same one every QuickBooks app uses. What comes back is an access key Intuit issues to the application, and you can revoke it at any time from QuickBooks. The connection dies on the spot. Nothing to reset, nothing to change on your side, no email to us.
If you take one operational habit from this page, take that one: you already hold the off switch.
Read-only until you decide otherwise
Every connection starts read-only. The assistant can read anything and change nothing. That is not a setting you have to find, it is the state you start in.
Turning on writes is per company, and you do it yourself in the portal. A bookkeeper can keep nine client files read-only while working in the tenth. Nothing propagates.
Even with full access on, three actions require an explicit confirmation in the conversation every single time: sending a document by email, voiding, and deleting. An assistant cannot email your customer or void an invoice on its own momentum.
Model training
Anthropic excludes MCP connector content from model training on every plan, including Free, regardless of your settings. There is nothing for you to configure on that side.
OpenAI differs by account type. Business, Enterprise and Edu are excluded. On a personal ChatGPT account, you turn it off yourself: Settings, then Data Controls, then switch off "Improve the model for everyone". Do that before connecting a real company file.
What we are not claiming
We are not claiming your numbers become untouchable. They travel to a model run by Anthropic or OpenAI, and they land in your conversation history, which lives in your account with that company under their retention rules, not ours. If a client contract or an engagement letter forbids that, no connector setting fixes it. That is a contract question, and it belongs to you.
We are also not claiming the assistant is always right. It can misread a report the same way a person skimming can. Anything headed for a filing, a lender, or a decision that matters gets checked against the report in QuickBooks. Accurate and safe are different properties and people conflate them.
Full detail on the architecture is on the security page.
If you are not comfortable with any of this
Two respectable answers, and neither of them is "get over it".
Connect read-only and never turn writes on. You get all 35 reports, the whole general ledger, aged receivables, budget versus actuals, everything, and the connection keeps zero ability to change your books. Plenty of connections should stay exactly like this forever, and the pricing is the same either way. There is no upsell to full access, see the pricing page.
Do not connect at all. If you hold client files under terms that do not allow a third-party processor, or you would not want to explain the arrangement to a client, then the right move is to skip the connector and export what you need. Run the report in QuickBooks, hand the export to the assistant, get the analysis, keep the connection out of it. You lose live data and you lose write access. For a lot of people that trade is correct, and we would rather say so than sell a subscription that ends in regret.
Once you have decided, the setup guide walks through connecting a first company read-only.