Built to be trusted with your clients’ books.
Numbers Game is built for an industry where trust is non-negotiable. Every write is proposed for your approval, every connection is scoped to what you authorize, and QuickBooks stays the system of record.
No badges we haven’t earned.
We won’t put certification logos on this page we haven’t earned. Here’s what’s actually true today: encryption in transit and at rest, access scoped to what you authorize, an independent penetration test in planning, and a human approving every write before it reaches your books. The details are below.
Your ledger stays the system of record. Always.
- № 01You authorize Numbers Game to access a QuickBooks Online or Xero company via the platform’s OAuth flow.
- № 02Numbers Game reads over the platform’s official API, only the scopes you approved.
- № 03When you approve a write action (a categorization, a journal entry, a report), Numbers Game posts back to QBO through the same API.
- № 04Source documents (PDFs, statements) are stored in encrypted object storage and attached as references in QBO.
- № 05Numbers Game never holds the only copy of your books. QuickBooks Online or Xero is always the system of record.
In transit, at rest, and at the keys.
In transit
TLS 1.3 for all connections, QuickBooks Online, Xero, Slack, Claude, the web app, the API.
At rest
AES-256 for all stored data, including source documents.
Secrets
OAuth tokens encrypted with envelope encryption; key rotation every 90 days.
Scoped to the connection, the role, and the action.
- OAuth scoping. Numbers Game requests only the scopes needed for the connection.
- Role-based access within the firm, partners, staff, view-only.
- Per-connection access. Staff can be assigned to specific client books.
- MFA available on all accounts.
The model proposes. You dispose.
- Numbers Game proposes every categorization, reconciliation, and journal entry, nothing is written to QuickBooks until you approve it.
- You see what it will do, and the data behind it, before you confirm.
- Connections stay read-only until you approve a write.
- QuickBooks Online or Xero is always the system of record, your books, your control.
The model never writes alone.
- Every proposed action shows what it will do and the data that informed it, so you approve with full context.
- Your client data is never used to train any model.
- Prompts and responses are isolated per firm and never shared across accounts.
- Numbers Game can read and draft, but it cannot post to your books on its own.
Monitored, documented, and notified.
- 24/7 security monitoring across all infrastructure.
- Documented incident response runbook.
- Customer notification within 72 hours of any confirmed incident affecting your data.
Where it lives, and for how long.
- EU (Oracle Cloud Amsterdam) by default.
- US and hybrid residency available on Enterprise.
- Data deletion within 30 days of account closure (subject to legal/tax retention requirements).
- Export your source documents at any time.
RFPs, vendor reviews, SOC 2 status letters.
We respond to vendor security questionnaires (CAIQ, SIG Lite, custom firm templates) within five business days. Email [email protected] for our latest security package: architecture diagram and DPA (and the penetration test report once the test is done).
Get the security package.
Architecture diagram and DPA, usually within five business days.