Encrypted API keys and QuickBooks tokens
Your firm’s AI provider keys and each client’s QuickBooks access tokens are encrypted at rest with AES-256-GCM before they are stored. After a key is saved, the app only ever shows its last four characters.
Security
How we protect your firm’s data.
Your firm holds sensitive financial information for every client. Here is plainly what AutoZonBooks does to protect it, and what it doesn’t claim.
Safeguards
Hashed passwords and sessions
Passwords are hashed with bcrypt; we never store them in plain text. Sign-in sessions use a random token in an HTTP-only, secure cookie, and only a hash of that token is stored on the server. Repeated failed sign-ins are rate limited.
Role-based client access
Staff are invited with a role: super admin, admin, manager, staff or read-only. Admins choose which clients each person can see, and the server enforces it on every request, not just in the screen.
Portal isolation
Client portal users are tied to a single company. The server only sends them their own company’s records, strips internal fields like vendor notes, and only lets them change specific fields, such as approving a bill or answering a to-do.
Read-only QuickBooks
AutoZonBooks only reads from QuickBooks Online: it runs queries and pulls reports. Neither the app nor the AI Close Agent creates, edits or deletes anything in your clients’ books. You can disconnect a client at any time.
Hosting and backups
AutoZonBooks runs on Render, with a managed PostgreSQL database that is reachable only from inside Render’s private network. Traffic is encrypted with HTTPS, and the database is backed up daily.
Files
Attachments, documents and voice notes are stored in the database and are only served to signed-in users with access to that client. Portal users can only download files that were shared with them or that they uploaded.
AI with your own key
The Close Agent uses your firm’s own AI account, so client data goes only to the provider you chose, under your agreement with them. Every run records the steps it took.
What we don’t claim
AutoZonBooks is a young product. We don’t hold third-party security certifications such as SOC 2 today, and we won’t pretend otherwise. If your firm has a security questionnaire, send it over and we’ll answer it honestly.
Security also depends on how an account is used: invite only the people who need access, give them the narrowest role and client list that works, and remove access when someone leaves.
Found a security issue? Please tell us through the contact form and we’ll follow up right away.
Questions about security?
Ask us anything during a demo. We’ll show you exactly what clients and staff can see.