How to evaluate accounting software security.
A practical security checklist for firms choosing AI accounting software, ledger connections, and workflow tools that touch client data.
Buy the control path, not the security page.
The relevant question is not whether an accounting vendor says it uses encryption or AI responsibly. It is whether the product can prove how a user, an AI client, and a specific client company are connected, limited, recorded, and revoked. The firm should be able to trace that path before it trusts a workflow with live books.
Numbers Game is an MCP tool provider for accounting firms. It connects a firm’s approved QuickBooks Online and Xero companies to the firm’s chosen AI client, while the ledger remains the system of record. It does not independently determine accounting conclusions. A qualified reviewer retains responsibility for the facts, applicable guidance, and final accounting judgment.
Start with OAuth 2.1 and per-company access.
Ask for an authorization model
Look for OAuth 2.1, PKCE, audience binding, short-lived access tokens, and revocation. A copied API key or a generic shared login cannot answer the same access questions.
Ask who chooses the companies
The person granting access should be able to choose all authorized companies or a selected list. The server should enforce that selection on every call, not merely show a checklist during setup.
Ask how access narrows
Offboarding, role changes, company restrictions, and connection revocation should invalidate the decision immediately or within a stated, short bound. A control that waits for a long token lifetime is not a practical revocation path.
Separate the ledger, the AI client, and the provider.
- System of record: confirm the product reads the ledger through the approved connection and does not replace it with a copied book.
- Storage: ask for an itemized answer, not a blanket claim. Financial imports, bank-feed lines, saved reports, booked summaries, logs, and backups can have different retention and encryption boundaries.
- AI data flow: identify whether the firm chooses its own AI client or the vendor sends data to a model provider. If a provider is involved, require the named provider, the exact data path, explicit consent, and a withdrawal mechanism.
- Pilots: pilot-gated features should be labelled as such. They are not general availability merely because the code exists or a test customer has used them.
A prompt is not the only control.
A client-side confirmation can help a reviewer see an intended action, but it is not a vendor-enforced authorization boundary. Ask what still prevents a model or user from reaching an unapproved company, what is logged, whether bulk work has a separate preview and apply step, and which actions are structurally excluded.
| Question | Evidence worth requesting |
|---|---|
| Can the product write to the ledger? | A clear read/write capability description, the role and company checks, and whether the AI client can suppress its own prompt. |
| Can it send something outside the ledger? | A server-side gate for irreversible external actions, not only a client-side approval prompt. |
| Can it move money or change the ledger account? | A documented refuse list. Numbers Game cannot initiate ACH, QuickBooks Bill Pay, or permanent QuickBooks deletion. |
| Can a firm audit work? | A firm-visible audit log that identifies the company, tool, result, and time without treating logging as permission. |
Ask what was tested and what changed.
Security testing should result in specific changes, not a generic assurance statement. Ask whether an external penetration test was commissioned, what the scope found, what was remediated, whether the tester retested, and whether an attestation exists. Numbers Game commissioned an external penetration test in October 2026. Trace’s retest concluded after the reported findings were addressed; the attestation letter is pending. This is not a certification and should not be described as one.
Also ask about the operating controls behind the report: credential encryption, key handling, access monitoring, vulnerability management, deployment checks, and the vendor’s stated incident-notice process. A trustworthy vendor can name the boundary of a control rather than implying that every risk has disappeared.
A 30-minute vendor security review.
- Map one real workflow: the person, AI client, ledger company, data source, proposed write, reviewer, and system of record.
- Ask the vendor to name the enforcement point for each boundary. A dashboard setting alone is not enough.
- Request a current subprocessor and retention disclosure, including the distinction between released features and pilot-gated features.
- Ask for the incident, testing, and remediation facts in writing. Avoid unqualified claims such as certified, autonomous, or never stores data unless the vendor can support them precisely.
- Keep the firm’s own professional review in the workflow. Security controls do not make an accounting conclusion automatic or replace qualified judgment.
What we state plainly.
Numbers Game uses OAuth 2.1 controls and firm, role, and company restrictions to govern a firm’s approved ledger access. Credentials are encrypted at rest, and the firm’s chosen AI client receives a separate Numbers Game authorization rather than a QuickBooks or Xero credential. QuickBooks Online and Xero remain the systems of record.
For generally available workflows, Numbers Game does not operate the firm’s model or send ledger data to Anthropic or OpenAI. A limited server-side AI runner is pilot-gated: it requires explicit consent that names the provider and can be withdrawn. Read the security disclosure and privacy policy for the product-specific details.
Accounting software security, answered plainly.
Review the control path.
Bring your firm’s real workflow, client-company boundaries, and procurement questions to a Numbers Game walkthrough.