FinShare carries other people's financial records, so it's built to do one job and leave a trail. This page covers how it handles QuickBooks access, stored data, links and keys. For the legal detail, see the privacy policy.
QuickBooks access
- Read-only by construction. The code that talks to QuickBooks only sends read requests for reports and company information. FinShare's test suite checks that every call it makes to the QuickBooks accounting API is a read.
- Only what was approved. Each pull is checked against the owner's approval when it runs, not just when it was queued. A pull under an approval that has since ended or been revoked doesn't run.
- Approval can't be widened. Refreshes and roll forwards reuse the approved reports and basis, with periods that only move forward.
- Tokens are released when they're not needed. When an access window ends or is revoked, and no other live approval uses that company, FinShare revokes its token at Intuit and stops holding it. Failed revokes are retried.
- One connection per company. If two requesters ask the same company, the approvals share one connection, so the owner has one thing to disconnect.
- Disconnects are verified. Intuit's disconnect notice can be reached by anyone, so FinShare confirms with Intuit that the connection is really gone before acting on it.
Stored data
- Encrypted at rest. QuickBooks tokens, company identifiers, raw QuickBooks responses, rendered files and webhook signing secrets are encrypted with AES-256-GCM. Keys are held outside the database, and every encrypted value records which key was used, so keys can be rotated.
- Immutable reports. The raw QuickBooks response behind each report, and the file delivered from it, can't be changed once stored. The database itself blocks edits and deletes.
- Nothing sensitive in logs. Financial figures, tokens and company identifiers are never written to logs.
- Separated by organization. Every query is scoped to the requesting organization. One organization can't see another's requests or reports. QuickBooks connections never appear in the app or the API.
Data is encrypted in transit with TLS. FinShare is hosted in the United States.
Owner links
- The links in owner emails (review, update approval, manage) are long random tokens. FinShare stores only a hash of each one.
- Every link expires. Issuing a new review link makes the old one stop working.
- Owner pages are rate-limited.
- Approval has to happen in the browser that connected QuickBooks, and only after the owner has seen which company they connected. A forwarded link alone can't release reports; whoever approves also has to sign in to QuickBooks as an admin.
- The access page sends its link only to an approver's email, and responds the same way whether or not the email has shared anything, so it can't be used to check who uses FinShare.
API keys and webhooks
- API keys are shown once when created. FinShare stores only a hash.
- In the dashboard, only account owners can create or revoke API keys and webhook endpoints.
- Webhook URLs must use https. Each endpoint has its own signing secret, shown once. Deliveries are signed with Standard Webhooks.
return_urlvalues must be on an origin your organization has registered, so FinShare can't be used as an open redirect.
The audit trail
Every action by your team, by an owner, by an API key or by FinShare itself is written to an append-only log. See Audit log.
What we don't do with data
From the privacy policy: FinShare doesn't sell personal or financial data, use it for advertising, build profiles from it, or use it to train machine-learning models.
Retention
From the privacy policy:
- QuickBooks access lasts for the period the owner approved, then the token is revoked.
- Raw QuickBooks responses and the files rendered from them are kept, encrypted, for as long as your organization keeps the request, so delivered files can be re-verified. You can ask us to delete a request's data at any time.
- Consent and audit records are kept for seven years.
Questions
Email support@finshare.io.