Security

Built to be trusted with your clients’ books.

Numbers Game is built for an industry where trust is non-negotiable. Every write is proposed for your approval, every connection is scoped to what you authorize, and QuickBooks stays the system of record.

Where we stand

No badges we haven’t earned.

We won’t put certification logos on this page we haven’t earned. Here’s what’s actually true today: encryption in transit and at rest, access scoped to what you authorize, independent annual penetration testing, and a human approving every write before it reaches QuickBooks. The details are below.

How your data flows

QBO stays the system of record. Always.

  1. № 01You authorize Numbers Game to access a QuickBooks Online company via Intuit’s OAuth flow.
  2. № 02Numbers Game reads from QBO over Intuit’s official API, only the scopes you approved.
  3. № 03When you approve a write action (a categorization, a journal entry, a report), Numbers Game posts back to QBO through the same API.
  4. № 04Source documents (PDFs, statements) are stored in encrypted object storage and attached as references in QBO.
  5. № 05Numbers Game never holds the only copy of your books. QBO is always the system of record.
Encryption

In transit, at rest, and at the keys.

01

In transit

TLS 1.3 for all connections, QBO, Slack, Claude, the web app, the API.

02

At rest

AES-256 for all stored data, including source documents.

03

Secrets

OAuth tokens encrypted with envelope encryption; key rotation every 90 days.

Access control

Scoped to the connection, the role, and the action.

  • OAuth scoping. Numbers Game requests only the QBO scopes needed for the connection.
  • Role-based access within the firm, partners, staff, view-only.
  • Per-connection access. Staff can be assigned to specific client books.
  • MFA available on all accounts.
Human in the loop

The model proposes. You dispose.

  • Numbers Game proposes every categorization, reconciliation, and journal entry, nothing is written to QuickBooks until you approve it.
  • You see what it will do, and the data behind it, before you confirm.
  • Connections stay read-only until you approve a write.
  • QuickBooks Online is always the system of record, your books, your control.
AI safety

The model never writes alone.

  • Every proposed action shows what it will do and the data that informed it, so you approve with full context.
  • Your client data is never used to train any model.
  • Prompts and responses are isolated per firm and never shared across accounts.
  • Numbers Game can read and draft, but it cannot post to QuickBooks on its own.
Incident response

Monitored, documented, and notified.

  • 24/7 security monitoring across all infrastructure.
  • Documented incident response runbook.
  • Customer notification within 72 hours of any confirmed incident affecting your data.
Data residency & retention

Where it lives, and for how long.

  • US tenancy by default.
  • EU and hybrid residency available on Enterprise.
  • Data deletion within 30 days of account closure (subject to legal/tax retention requirements).
  • Export your source documents at any time.
Security questionnaires

RFPs, vendor reviews, SOC 2 status letters.

We respond to vendor security questionnaires (CAIQ, SIG Lite, custom firm templates) within five business days. Email [email protected] for our latest security package: pen test summary, architecture diagram, and DPA.

Get the security package.

Pen test summary, architecture diagram, and DPA, usually within five business days.