Where client QuickBooks data lives when a firm or fractional CFO connects Claude.
I run AG Accounting. I also built Numbers Game, with one other person. The product is the pipe we already use on our own book. I am still on both sides of this table.
A bookkeeper can shop on a demo. A CPA firm cannot.
Last year a partner stopped me before we connected a single client file. He did not want the marketing version. He wanted a sentence that would survive an engagement letter, a professional liability carrier, and a client who actually reads the email. A fractional CFO asked the same question the next month without a license hanging over it. The founder still wanted to know who could see the books.
I run AG Accounting. I also built Numbers Game, with one other person. The product is the pipe we already use on our own book. I am still on both sides of this table.
When a CPA firm or a fractional CFO connects Claude to a client QuickBooks Online company through Numbers Game, the ledger stays in QuickBooks. We read QBO on request over Intuit’s OAuth connection. We store the company name, the RealmID, the users on the firm account, encrypted OAuth tokens, and a log of actions. We do not keep a copy of the books. The prompts and the numbers Claude sees live in the firm’s own Claude project, under the firm’s own Anthropic (or OpenAI) agreement. Writes are proposed, not silent. SOC 2 Type II is in progress, with a report expected in Q3 2026. You tell clients that, because a vendor page cannot discharge a professional obligation, and it cannot discharge a founder’s question about who can see the books.
Bookkeepers ask whether the connector is fast, whether the category looks right, whether the partner will like the PDF. Fair questions. They are not enough if your name is on a compilation.
A licensed firm signs compilations, reviews, tax returns, and, in some shops, attest work that sits next to the same QBO file the model can now read. Peer review can ask how the file was prepared. The carrier can ask which third parties touched client financials. State boards still treat confidential client information as the firm’s problem. AICPA Code of Professional Conduct ET 1.700 is not a slogan. If a client trial balance crossed an API you authorized, you should be able to say so without hedging.
I have watched firms try the bookkeeping-shop purchase: demo, a rec from another bookkeeper, Connect. Then the partner remembers the license. Asking for a CPA-firm peer, a DPA, and a written SOC 2 timeline is diligence, not theater. We will tell you where it lives.
No CPA license, still a client-trust problem.
Fractional and outsourced CFOs do not have a compilation letter to update. There is no peer review, no ET 1.700. There is still a founder who handed you the books, and a question about whether the vendor can open the P&L.
The data path does not change because you are not licensed. Same connector, same stored metadata, same do-not-train setting on your Anthropic (or OpenAI) organization, same SOC 2 sentence: Type II in progress, report expected Q3 2026. You still cannot tell a client we “are SOC 2.”
What changes is the document. A CPA firm puts this in an engagement letter because the license requires it. A fractional CFO puts it in the MSA or the kickoff email because the client asked who can see the books, and “we are not a CPA firm” is not an answer. If their policy forbids a vendor without a current Type II report, keep that company off the connector.
What actually happens when someone asks Claude a question.
Nobody exports a company file and uploads it to a chatbot. Nobody pastes a trial balance into a window and calls that “connected.”
- 1. An Owner or Admin at the firm authorizes Numbers Game to access a QuickBooks Online company through Intuit’s OAuth flow. The firm picks the company. Intuit issues tokens. QuickBooks remains the system of record.
- 2. Someone on the team opens that client’s Claude project and asks a question, or runs a close job. Claude calls Numbers Game over MCP.
- 3. Numbers Game reads from QBO over Intuit’s official API, only for the scopes and the company the firm approved, and only for that request.
- 4. The connector hands the response to the firm’s model. Claude (or ChatGPT) does the reading, the drafting, the comparison.
- 5. If the work would change the books, Numbers Game proposes the write. A person approves it. Only then does it post back through the same API.
Xero follows the same pattern where the firm has connected Xero. The system of record does not move.
If Numbers Game disappeared tomorrow, the client’s books are still in QuickBooks Online. That is the recovery plan, and it is why I built a pipe instead of a shadow ledger. The model that sees the numbers is the firm’s model.
For encryption, tenancy, and the questionnaire pack, use the security page and the privacy policy. What follows is what a partner says out loud.
What we store, and the questionnaire you will fail if you get this sloppy.
Firms miss this in both directions. Some assume we warehouse every transaction. Some assume we store nothing. A sloppy “we never store your data” sentence is how you fail a client’s IT questionnaire at 4pm on a Friday.
What is stored
- Connection metadata: company name and RealmID (Intuit’s identifier for that QBO company). That is how the connector knows which file you meant.
- Firm users and roles. Who can see which connection. The roles and access page is the matrix.
- Encrypted OAuth tokens, so the connection survives more than one afternoon. Tokens are not a copy of the books. They are the right to ask QBO a question.
- An action log. Which tool ran, against which client, with what outcome. You will want this in a dispute. CPA firms should insist on it.
- Explicit exceptions, not a hidden archive. Saved reports (retention you control), import rows that posted, and generated PDFs that auto-delete 24 hours after creation.
What is not stored
- The ledger. Chart of accounts, transactions, journal entries, vendors, customers: read on request, not parked in a Numbers Game database as a second set of books.
- A training corpus. Client data is not used to train a Numbers Game model. There is no Numbers Game model. The firm brings Claude or ChatGPT.
If a security questionnaire asks “do you store client financial data,” skip the slogan. Answer: connection identifiers and tokens, an activity log, and the saved-report exception if we use it.
Can Numbers Game staff see your clients’ books?
Partners want a sentence that says the vendor cannot see the books. The honest version is narrower, and it is still a good sentence.
There is no stored copy of the ledger for anyone here to browse like a QBO user. Prompts and outputs live in the firm’s own Claude (or ChatGPT) workspace. We do not sit in that project. Do-not-train is a setting you control on your Anthropic (or OpenAI) organization, not a favor we grant.
What we hold is the stored list above: connection metadata, an action log, and whatever a support ticket includes if you paste it to us. Do not paste a trial balance into email.
Production access by Numbers Game personnel, when it happens, is logged, time-bound, and reviewed. That is on the security page. It is not a spare login to your client’s P&L.
Lock do-not-train at the Claude organization level. Gemini does not speak MCP, so it is not in this path at all.
Nothing posts until a person says so.
A silent write is a control failure. If an integration can post a journal entry because a model felt 91 percent sure, you have given a non-signer authority over a ledger you will later represent. I will not do that on our book, and I will not build a product that does it on yours.
Numbers Game proposes the categorization, the journal entry, the reconciliation. A person sees the net debits and credits and approves. Nothing hits QBO until that happens. The accountant is still in the chair.
You can tell a client, in writing, that no model posts to their books on its own. Do not then write a firm instruction that says “post it and tell me after.” That sentence turns the rail off.
Offboarding a contractor is three cuts, not one.
Seasonal staff, offshore reviewers, contractors with their own Claude login: every CPA firm has some mix of these, and so does a fractional CFO who lent a contractor “just the four entities.” The failure I keep seeing is the same. You remove them from the practice portal and from Numbers Game. They still have a Claude project that can call the connector.
- Remove the person in Numbers Game so their role no longer authorizes tool calls. See roles and access.
- Remove them from the Claude (or ChatGPT) project and from the firm’s Anthropic organization. If they used a personal Claude account you invited, revoke the invite.
- Confirm the Intuit connected-app list on any company they had reason to open. Revocation on the Numbers Game side takes effect in about thirty seconds. Still check Intuit.
Individual Claude plans have no central off switch. Be on Teams or Enterprise before you hand a contractor a live client file.
What you can honestly say about SOC 2 in 2026.
I will not put a badge on a page we have not earned. Two people, a small number of CPA firms and fractional CFOs, hundreds of QBO connections. SOC 2 Type II is in progress. The report is expected in Q3 2026. For the rest of 2026 you cannot tell a client we “are SOC 2.” You can tell them the audit is underway, send the security package (pen test summary, architecture diagram, DPA), and name the controls that exist today: TLS 1.3, AES-256 at rest, envelope-encrypted tokens, per-firm tenancy, OAuth not passwords, human approval before write, QBO as system of record.
CPA firms have a client disclosure obligation a vendor FAQ cannot meet. If your vendor sheet says “we only use SOC 2 Type II subprocessors,” you have a conflict. Wait, disclose the exception, or do not connect the file. A fractional CFO still has a founder who will ask. Same three choices.
A client paragraph that has survived partner review looks like this:
- We remain your accountants (or your fractional CFO). QuickBooks Online remains the system of record for your books.
- We use a connector, Numbers Game, so our team can pull reports and prepare proposed entries from Claude. It stores the company name, a technical ID, our user list, and a log of what we did. It does not keep a second copy of your ledger.
- The analysis happens in our Claude account. Anthropic is our AI provider, on our agreement. We do not use your data to train a model.
- Nothing posts to your books until a person at this firm approves it.
- Numbers Game’s SOC 2 Type II audit is in progress, with a report expected in Q3 2026. It is not complete today. We can share their current security package. If your policy forbids any vendor without a current Type II report, say so and we will keep this file off the connector.
That last sentence is the one firms skip. Put it in. Do not promise certifications we have not completed. Do not say “we never see your data.”
Who owns the data when you leave.
The client owns their books. The firm is the controller of the client records it authorizes the connector to process. Numbers Game is the processor for those records. That split is in the DPA.
On account closure, client records are deleted or returned within 30 days at the firm’s election, subject to legal and tax retention the privacy policy already names. Disconnecting Numbers Game does not delete the client’s QuickBooks.
The DPA will not clean these up for you:
- Claude project residue. Chats, uploaded files, saved reports sitting in the project. Those live on your Anthropic (or OpenAI) account.
- Saved reports inside Numbers Game, if you used that exception.
- The activity log. Export a copy for workpapers before you terminate, if you need one.
- OAuth. Revoke the Intuit connection. Confirm in QBO’s connected-apps list that it is gone.
A client who fires the firm still has their QBO. The messy leftover is the conversation history in Claude. Treat it like a shared Drive folder on offboarding.
Engagement letters, peer review, and the carrier.
I am not your lawyer. These are the questions that keep landing in partner conversations. They are CPA-specific because the license is the point. Fractional CFOs can skip the carrier and still use the client paragraph above.
Does connecting Claude waive confidentiality? No, not by itself. You are using a processor and an AI provider you selected, the way you already use QBO. The client still needs to know. If they were not told, the carrier will not like it.
Do we need a SOC 2 Type II report to use this in 2026? You need a position. Some firms will not onboard a vendor without the report. Honor that. Other firms will use a vendor under a DPA, a pen test, and a written disclosure that Type II is in progress. Putting “SOC 2” on a proposal because the audit started is not.
Will peer review care? Reviewers care how the financials were prepared. An activity log plus proposed-then-approved writes is better evidence than “we used some AI.” A chat transcript with no tie-out is not workpapers. Save the reports you signed.
What belongs in the engagement letter? Name the tools at the level you name QBO: an MCP connector plus the firm’s own Claude or ChatGPT account, human approval before posting, SOC 2 Type II not yet available (expected Q3 2026), and the right to opt a company out. Structural cannot-dos are on the features page.
Data path questions, answered.
Book a walkthrough with a live file.
Bring one client QBO company and the disclosure paragraph your partner wants to use. We will walk the data path on that file, not on a demo company.