Security
The architecture: a relay, not a warehouse
Caribooks bridges QuickBooks Online and the AI, whether the request comes from your assistant or from a loop running on our side. We keep no copy of your ledger: every run reads QuickBooks live, and the only accounting that stays with us is what a proposal has to quote to make sense, such as a payee, an amount and a memo. The rest of this page says exactly what we keep.
What we keep about your account
Your email, the names of your connected companies, and your QuickBooks access tokens, encrypted with AES-256-GCM. Payments run through Stripe; card numbers never touch our servers.
What loops keep
A loop leaves a trail, per company: the rules you state, the loop itself (your sentence and its card), a summary of every run with its questions, what it consumed and what it cost, and every proposal with its evidence and the action it would apply. For a change that was applied, we also keep the record before and after, or the Undo button would have nothing to restore. All of it stays while the company is connected, and is deleted with your account.
The documents you drop off
A receipt dropped in the portal or sent to your Caribooks address waits in private storage until it is attached to its expense; once it is in QuickBooks, the original is deleted from our side. A document nobody matched is swept after 90 days. A statement or a reference document, a rate sheet or a contract, stays until you delete it.
Where all of this lives
The database and the storage are on Supabase, in the AWS Montréal region (ca-central-1); the app runs on Vercel in Montréal (yul1). One exception is worth naming: the engine that moves a run forward, Vercel Workflow, keeps its state in the iad1 region, in Virginia. That state holds the run's conversation with the model, so the records it read.
A token, never your password
Connecting a company goes through the standard Intuit authorization (OAuth). Intuit hands us a token that only opens your books; we never see your QuickBooks password. You can revoke that token at any time, from the Caribooks portal or directly with Intuit, and access dies immediately.
Read-only by default
A connected company starts read-only: the assistant looks, nothing moves. Write access is enabled company by company, by you alone, and every delete requires an explicit confirmation in the conversation.
A loop starts by asking
A new loop proposes and waits: nothing moves in your books without your approval. You then decide, action by action, what it may do on its own. Deleting, voiding and sending a document always require your confirmation, whatever the setting. Every applied change can be undone, and you can pause one loop, or all of them.
Passwordless sign-in
Your Caribooks account opens with a magic link sent to your email. No Caribooks password exists, so there's no password to steal.
Your books don't train the models
Loops go through OpenRouter, which forwards each request to the model's provider, Anthropic for Claude. OpenRouter trains no model and, with logging off on our account, keeps nothing that passes through; Anthropic does not train its models on what goes through its API. When you instead query your books from your own assistant, Anthropic excludes MCP connector content like Caribooks from training on every plan; on ChatGPT, Business, Enterprise and Edu plans are excluded, and one setting covers personal accounts. Either way, your QuickBooks data is not sold and not used to train anything. Both providers' published policies are linked from our homepage.
What the model sees
A run sends the model provider what it has to read to do its job: the transactions in the period, the documents it handles, your rules, and the sentences you wrote. Models from other providers, reached through OpenRouter, are used only for our own benchmarks on Peich Technologies' books; they never see a customer's data.
On disconnect
Disconnecting a company revokes the token with Intuit and deletes it from our servers. Deleting your account erases the rest: rules, loops, runs, proposals and the documents you dropped off. These are also your rights under Quebec's Law 25.
What Caribooks cannot do
Intuit's API does not open everything, and we won't pretend otherwise. A loop cannot see the bank feed's For review queue, cannot reconcile an account, cannot move money and cannot read payroll. What it touches is the entries and the documents inside QuickBooks.
What we don't have
No SOC 2 audit yet: we're a small team and we won't claim certifications we don't hold. The day we earn one, it will be listed here. To report a vulnerability or ask anything: support@caribooks.com, and we answer fast.