Security & trust
You’re connecting your financial data. Here’s exactly how it’s handled.
This page describes what JobProfitAI actually does, not a list of badges. It also says plainly what we have not done, because a security page that only lists good news isn’t useful to anyone making a real decision.
What we don’t claim
JobProfitAI does not hold SOC 2, SOC 2 Type II, ISO 27001, HIPAA or PCI certification, and has not completed a third-party penetration test or security audit. We’re a young product and we’re not going to put badges on this page that we haven’t earned. What follows is a factual description of the controls that are actually in place today.
QuickBooks connection
How the QuickBooks authorization works
You authorize through Intuit, not through us
Connecting uses Intuit’s standard OAuth 2.0 flow. You’re redirected to Intuit’s own website to sign in and approve access. Your QuickBooks username and password are never entered into JobProfitAI, never transmitted to our servers, and never stored by us in any form.
The authorization endpoints we use are read from Intuit’s live OAuth discovery document rather than hardcoded, so we follow Intuit’s current configuration.
The connection request is protected against forgery
Each connection attempt carries a short-lived, cryptographically signed state token tied to your logged-in session and valid for ten minutes. When Intuit redirects back, that signature is verified before anything is stored. A callback with a missing, expired or altered state token is rejected rather than trusted.
What JobProfitAI does with the access it's given
JobProfitAI only reads from QuickBooks. It does not create, modify or delete invoices, bills, customers, projects or any other record in your books. Every call the application makes to QuickBooks is a read.
To be precise rather than reassuring: the connection uses Intuit’s standard accounting scope, which is the scope Intuit provides for accounting data access. We describe our behaviour as read-only because that is what the software does, not because Intuit issues a separate read-only credential.
Tokens and your company ID are encrypted before storage
The OAuth access token, the refresh token, and your QuickBooks company (realm) ID are each encrypted with AES-256-GCM at the application layer before they are written to the database. The encryption key lives in the server environment, never in the database and never in source control, so a database dump or backup on its own does not yield usable credentials.
Because encrypted values can’t be searched, we also store a one-way SHA-256 hash of the company ID purely as a lookup key. The plain company ID is never stored.
You can disconnect at any time
Disconnecting from Settings calls Intuit’s token revocation endpoint to invalidate the connection on Intuit’s side, then marks the connection inactive here. You can also revoke access from within QuickBooks itself at any time; if you do, JobProfitAI detects it on the next sync and shows a Reconnect QuickBooks button rather than silently retrying.
Your data
What we store, and what we don't
What is stored
To produce profitability analysis, JobProfitAI stores a copy of the job-related data it reads from QuickBooks: jobs (QuickBooks Projects) and the customer each belongs to, cost line items from bills, expenses, purchases and time activities, invoice totals and status, estimate values, and the profitability figures calculated from them. It also stores each Weekly Profit Brief and the profit insights generated for you, and your own settings such as target margin and email recipients.
What is not stored
We do not store your QuickBooks password, your bank account details, your customers’ payment information, payroll records, or document attachments from your QuickBooks file. We do not store credit card numbers. See the billing section below.
Every account's data is isolated from every other account
Each QuickBooks connection belongs to exactly one JobProfitAI account. Every request that touches financial data verifies, on the server, that the signed-in account owns the connection or job being requested, a request for a record belonging to another account returns not-found, regardless of what the browser asks for.
Being an accountant, a referral partner, or a referrer confers no access to any other business’s financial data whatsoever. Partner dashboards show counts and commission amounts only, never a client’s numbers.
Logging is deliberately restricted
Application error logs record status codes and Intuit’s request-tracing ID only. Raw API responses, request bodies and error objects from QuickBooks are never logged, because those can echo back credentials or customer financial data.
Deleting your account deletes your data
You can permanently delete your account from Settings. Doing so revokes any live QuickBooks connection with Intuit, cancels any active subscription, and deletes your account together with the jobs, cost data, invoices, weekly briefs and insights derived from it. Deletion is irreversible and requires re-entering your password.
Two kinds of record outlive a deleted account. If an accounting partner referred you, the commission records for payments you made are kept so the partner can be paid correctly: they hold amounts, dates and internal and Stripe reference numbers, not your name, email or any QuickBooks data. And Stripe keeps its own record of your payments, as a payment processor must.
Application & infrastructure
Authentication, transport and hosting
Authentication
Passwords are hashed with bcrypt (work factor 12) and never stored in a recoverable form. Sessions use a signed token in an HTTP-only cookie, which browser JavaScript cannot read, marked Secure in production and scoped with SameSite protection against cross-site request forgery.
Transport
The application is served exclusively over HTTPS. All communication with Intuit, Stripe and our email provider is over TLS.
Hosting and database
JobProfitAI runs on Vercel, with a managed PostgreSQL database hosted by Neon. Database access is restricted to the application via a credential held in the server environment. Secrets, meaning database credentials, the token encryption key and API keys, are stored as environment variables in the hosting platform, never committed to source control, and never exposed to the browser.
Payments
Billing is handled by Stripe. Card details are entered on Stripe-hosted pages and are never transmitted to or stored on JobProfitAI systems. We hold only Stripe’s identifiers for your customer and subscription. Stripe is a PCI Service Provider Level 1; that is Stripe’s certification, not ours, and it applies to their handling of card data.
Incoming billing events from Stripe are cryptographically signature-verified before being processed, so a forged request cannot alter your subscription state.
Transactional email, meaning your Weekly Profit Brief and trial and billing notices, is sent through Resend from a verified JobProfitAI sending domain. Emails go only to the address on your account and the recipients you configure, and the Weekly Profit Brief isn’t sent until you’ve confirmed your own address.
Artificial intelligence
Profit insights and the written summary in the Weekly Profit Brief are produced by Anthropic’s Claude API. What is sent is the calculated profitability data for your jobs: job names, the customer names attached to them, job types and computed figures. The model writes explanatory prose only; the “What changed” section of the brief is calculated, not written by it. Every dollar amount, percentage and confidence level in a finding is calculated by the application and stored separately from the text, and each finding names the jobs it came from, so you can check any figure against the job pages. Your QuickBooks credentials are never sent to any AI service.
Security questions, or something to report?
We’d rather hear from you than not. If you have a question about how your data is handled, or believe you’ve found a vulnerability, email us directly and we’ll respond.
support@jobprofitai.comSee also our Privacy Policy and Terms of Service.