Security at NumbersGame.
NumbersGame connects your firm’s AI client to your clients’ QuickBooks Online and Xero books. This page describes the controls protecting that connection and the data behind it, as they operate today.
What is in place today.
Penetration test
Independent test by Trace, October 2026. Zero critical findings; all high findings remediated and verified by Trace; zero open.
Certification
We do not hold SOC 2 or ISO 27001 certification. Our controls are described here and tested independently.
Data location
Hosted on Oracle Cloud Infrastructure in the EU, Amsterdam region.
No badges we haven’t earned.
External penetration test
Trace Offensive Security tested the production application and cloud environment from October 16 to 19, 2026. The assessment combined authenticated and unauthenticated testing of the live system with a review of application and infrastructure source code.
Results and retest
Trace reported 27 findings: 0 critical, 4 high, 9 medium, 6 low and 8 informational. Twenty-five were remediated and verified on retest; two are accepted with documented compensating controls; zero are open.
Attestation
Trace’s Letter of Attestation, TR-LOA-2026-10-NUMBERSGAM-133201, was issued October 23, 2026. It is available to customers on request and can be verified with Trace.
Code reviews
The codebase has also been through independent security reviews in 2026. Every finding was either fixed or recorded with a reason.
Certification
We do not hold SOC 2 or ISO 27001 certification, and no audit is under way. We answer security questionnaires directly.
Privacy and GDPR
NumbersGame B.V. is established in the Netherlands and subject to the GDPR. For your clients’ ledger records, we act as a processor under your instructions. A Data Processing Agreement is available.
Your credentials stay with the provider.
Provider sign-in
QuickBooks, Xero, Stripe, Square, Ramp, Shopify and bank connections use OAuth on the provider’s own sign-in and consent screen. We receive an access token, never a password.
AI-client separation
Claude, ChatGPT and other AI clients sign in to NumbersGame, not to QuickBooks or Xero. The AI client receives a separate token for our connector; NumbersGame makes the ledger call server-side with the provider token we hold.
Connector authorization
NumbersGame operates an OAuth 2.1 authorization server with PKCE using S256. Tokens are bound to a single connector, access tokens expire after 30 minutes, refresh tokens rotate on every use, and reuse of an old refresh token revokes the entire grant.
Company scope
When an AI client is approved, the user chooses all available companies or a specific list. That choice is enforced on every tool call and can be changed under Security → Connected applications. Adding companies requires a password or passkey.
Immediate revocation
Revoking an AI connection, removing a team member, lowering a role, or restricting a company takes effect on the next request.
MCP keys
For automation tools that can only send a fixed key, users can create an MCP key. It uses the same consent process, opens one connector, is read-only or read-write by explicit choice, expires after 90 days, is shown once, and is visible to owners and admins.
Scoped to the person, company, and action.
- Passkeys. WebAuthn passkeys are supported and recommended.
- Passwords. Passwords are hashed with Argon2id and a server-side secret, so a database copy alone is not enough to test password guesses.
- Two-step sign-in. It can be enabled per user or required for the whole firm. The second factor is a passkey or an emailed one-time code.
- Re-authentication. Required for sensitive actions such as turning off two-step sign-in, adding a passkey, granting admin rights, or approving an AI connection.
- Credential recovery. A password reset revokes sessions, AI connections, passkeys and MCP keys held by the account.
- Brute-force protection. Rate limits at the network edge and in the application, restart-safe account lockout, and bot protection on sign-up and password reset.
| Role | Can |
|---|---|
| Owner | Everything, including billing, firm deletion and data export. |
| Admin | Manage team, companies and firm settings. |
| Member | Read and write in companies they can access. |
| Viewer | Read only, enforced server-side regardless of what the AI client requests. |
Owners and admins can restrict individual team members to specific companies. A restricted company is hidden from that person in both the portal and the AI client.
Visibility
The audit log records every tool call with the person, company, tool, result and time. Owners and admins have a firm-scoped usage dashboard and can revoke connected applications in one click.
Staff access
NumbersGame staff accounts require a password and passkey on every sign-in. There is no emailed-code fallback or remembered-browser exception. Changes to a staff passkey alert the team.
Ledger data is read live, not copied wholesale.
QuickBooks and Xero transactions, balances and reports are fetched for each request and are not stored by us. We store what is needed to run the service and the data you choose to save or import.
| What we store | How it is protected |
|---|---|
| Provider tokens | QuickBooks, Xero, Stripe, Square, Ramp, Shopify, bank feed and Slack tokens are encrypted with AES-256-GCM per record. |
| Saved reports and imported statement rows | Encrypted with AES-256-GCM under a separate key. |
| AI connector tokens and MCP keys | Stored only as a keyed hash. The raw value is shown once. |
| Bank-feed and commerce data | Disk encryption and database access controls when these features are used. |
| Firm account data and audit logs | Disk encryption and database access controls. Free-text audit parameters are redacted. |
Encryption
TLS on every connection, HSTS on every hostname and a strict Content Security Policy on the portal. Field-level AES-256-GCM supplements encrypted storage. Keys and secrets are held in a managed cloud key vault, not in plaintext on disk or source code. Backups are encrypted before upload.
Tenant isolation
Customers share one platform, separated by firm. Every tool call passes through one authorization layer. The firm is taken from the authenticated token, never the request, and requests for companies outside the firm receive the same result as nonexistent companies.
Retention, deletion and export
Company and firm deletion has a 30-day recovery period before hard deletion. Backups can retain deleted data for up to 8 weeks. Generated PDFs are deleted after 1 hour. Owners can request a logged firm export, available only to the signed-in owner and deleted after 24 hours.
AI providers
NumbersGame does not send your data to an AI provider. Your AI client calls our connector and we answer its requests. Pilot features that would send data to an additional provider are off by default and require explicit, revocable firm consent naming the provider.
Controls in the tools, not a policy document.
- Every tool is labelled read-only or write. Approval prompts belong to the AI client; choosing its always-allow setting stops those prompts.
- Bulk changes are split into a preview and a separate apply step.
- Bank-statement imports check for duplicates, can run as a dry run, and can be reversed in one step.
- Writes and deletes are rate-limited per company to stop runaway loops.
- Changes to transactions inside a completed QuickBooks reconciliation are refused unless a reason is given.
What it cannot do
Permanently delete ledger history; move money through ACH, bill pay, cards or refunds; change QuickBooks or Xero account settings; file payroll returns; send social-security numbers to QuickBooks; or make changes to Ramp or Shopify. Ramp and Shopify connectors are read-only.
Client-customer email
Sending invoices and other documents by email is off by default and needs three separate switches on our side and yours. A changed recipient address is held until a person confirms it in the portal.
Operational controls that keep running.
Network
All traffic passes through Cloudflare. Servers accept no direct inbound web traffic. Administrative access is key-based only from restricted networks.
Vulnerability management
Production servers are scanned daily against published CVEs and a CIS benchmark. High and critical vulnerabilities are fixed within 48 hours of a fix becoming available. Operating-system security updates install nightly.
Monitoring and detection
Centralized structured logging alerts on errors and security events. Server audit records are copied off-server within minutes into storage that cannot be changed or deleted for 90 days. Production also uses runtime threat detection, file-integrity monitoring and nightly anti-malware scans.
Secure development
Every change goes through a pull request. Changes to authentication, authorization, database migrations, security headers and the deployment pipeline require approval from someone other than the author. Automated checks include real-database tests, secret scanning across history, static analysis and workflow scanning.
Backups
The database is backed up nightly. Backups are encrypted before leaving the server and stored off-site.
A small vendor footprint.
We use Oracle Cloud for hosting, Cloudflare for network delivery and encrypted backups, Stripe for billing, Resend for email, Better Stack for logs and uptime, and PostHog EU for product analytics with text and inputs masked. The current list and processing details are in the Privacy Policy. Intuit, Xero and your AI provider are services you connect, not our subprocessors.
Tell us directly.
If you find a vulnerability or suspicious email, write to security@numbersgame.xyz. Include reproduction steps and allow a reasonable time for remediation before disclosure.
On request, we provide Trace’s Letter of Attestation, our Data Processing Agreement, the subprocessor list, and answers to your security questionnaire. Signed-in customers can also open the compliance page in the portal.
This page describes controls in place on October 28, 2026. It is not a certification and does not change the terms of your agreement with us.
Get the security package.
Request the DPA, Trace attestation, subprocessor list, or a response to your security questionnaire.