It depends on three things you can actually check: what the connector stores, what it is allowed to do to your books, and whether the assistant's operator trains on what it sees. Anyone answering "yes, totally safe" without addressing those three is selling. Here are ours, in order.
What is stored, and what is not
The connector is a relay. A question goes to QuickBooks, the answer comes back to the assistant, and no synchronized copy of your ledger is kept in between. No cached reports, no customer or invoice list on our side.
What the connector stores is what the service cannot function without:
- Your account email address, billing details and usage records.
- The details of the companies you have connected.
- Any bookkeeping rules or task instructions you save.
- Your QuickBooks access tokens, AES-256 encrypted, on infrastructure hosted in Canada (AWS Montréal region).
Two optional features keep more. The document box stores the files you send it and the text read from them. Autopilot stores its instructions, conversations, run history and proposals, and that history can include QuickBooks data. Do not read any of this as "nothing worth stealing", though. The tokens are the sensitive part: whoever holds one can read the books it is bound to until it is revoked. That is why they are encrypted, and why revocation matters more than any other control on this page.
A token, not a password
We never receive your QuickBooks password. Authorization happens on Intuit's own screen, the same one every QuickBooks app uses. What comes back is an access key Intuit issues to the application, and you can revoke it at any time from QuickBooks. The connection dies on the spot. Nothing to reset, nothing to change on your side, no email to us.
If you take one operational habit from this page, take that one: you already hold the off switch.
Read-only until you decide otherwise
Every connection starts read-only. The assistant can read anything and change nothing. That is not a setting you have to find, it is the state you start in.
Turning on writes is per company, and you do it yourself in the portal. A bookkeeper can keep nine client files read-only while working in the tenth. Nothing propagates.
Even with full access on, three actions require an explicit confirmation in the conversation every single time: sending a document by email, voiding, and deleting. An assistant cannot email your customer or void an invoice on its own momentum.
Model training
On Claude's Free, Pro and Max plans, Anthropic's article on model training says the raw content returned by connectors, remote MCP servers included, is not used to train its models. The conversation itself can be, if you allow it: your questions and Claude's answers, which quote your figures. Turn off model improvement in your Privacy settings before you connect a real company file. Team and Enterprise plans fall under Anthropic's commercial terms instead.
OpenAI differs by account type. Business, Enterprise and Edu are excluded. On a personal ChatGPT account, you turn it off yourself: Settings, then Data Controls, then switch off "Improve the model for everyone". Do that before connecting a real company file.
What we are not claiming
We are not claiming your numbers become untouchable. They travel to a model run by Anthropic, OpenAI or Microsoft, and they land in your conversation history, which lives in your account with that company under their retention rules, not ours. If a client contract or an engagement letter forbids that, no connector setting fixes it. That is a contract question, and it belongs to you.
We are also not claiming the assistant is always right. It can misread a report the same way a person skimming can. Anything headed for a filing, a lender, or a decision that matters gets checked against the report in QuickBooks. Accurate and safe are different properties and people conflate them.
Full detail on the architecture is on the security page.
If you are not comfortable with any of this
Two respectable answers, and neither of them is "get over it".
Connect read-only and never turn writes on. You get all 35 reports, the whole general ledger, aged receivables, budget versus actuals, everything, and the connection keeps zero ability to change your books. Plenty of connections should stay exactly like this forever, and the pricing is the same either way. There is no upsell to full access, see the pricing page.
Do not connect at all. If you hold client files under terms that do not allow a third-party processor, or you would not want to explain the arrangement to a client, then the right move is to skip the connector and export what you need. Run the report in QuickBooks, hand the export to the assistant, get the analysis, keep the connection out of it. You lose live data and you lose write access. For a lot of people that trade is correct, and we would rather say so than sell a subscription that ends in regret.
Once you have decided, the setup guide walks through connecting a first company read-only.