Security
Your books. Our responsibility.
You are handing us a window into your company's money. We treat that as the most important thing we do. This page is the full picture: who can see your data, how it is protected, who we rely on, and how we prove it. Written to be read by your IT or accountant, not just skimmed. No security theater.
Download the one-page brief (PDF)At a glance
- Read-only access to your accounting. We can never move money or change your books.
- Every company is isolated at the database layer with forced row-level security, not just in app code.
- Connection tokens are encrypted with AES-256-GCM; all traffic is TLS.
- Payments run through Stripe (PCI DSS Level 1). We never receive or store card numbers.
- Your data is never sold, never shared with other customers, and never used to train public AI models.
- Industry benchmarks are opt-in and anonymized; off by default.
- A security suite (isolation test, secret scanning, dependency and static analysis) runs on every deploy.
- Disconnect or delete anytime. Revoking access is one click on your side.
Who can see your data
Access is tightly controlled and enforced by the database, not left to trust.
You. The owner who connected the account. Full access to your own books and everything StashGrade derives from them.
Team members you invite. Only the people you add by email, at the role you give them. They see your company and nothing else. Remove them in one click and their access ends.
A consultant, only if you opt in. If you work with a Consult Partner, they see your dashboard only after you explicitly turn sharing on in Settings. Off by default. Turn it off and their access ends.
Who never can
- Other StashGrade customers. Ever. One company can never see another company’s data.
- Buyers, advertisers, or data brokers. We do not sell or rent your data to anyone.
- Public AI models. Your books are never used to train models that serve anyone else.
StashGrade staff access company data only when strictly necessary to operate or support the service (for example, to help you with a problem you report), never to browse, share, or sell it.
Read-only by design
StashGrade connects to QuickBooks through Intuit’s official OAuth flow. You approve the connection on Intuit’s own page, with your own QuickBooks login. We never see or store your QuickBooks password.
We use the connection only to read: invoices, expenses, payroll categories, and your profit-and-loss, so we can build your scorecard. StashGrade does not create, edit, or delete anything in your books, and it has no ability to move money. The same is true of every other source you connect (Jobber, JobNimbus, and the rest): read-only.
Your books are isolated at the database level
Every table that holds customer data is locked to a single company with forced row-level security. The isolation is enforced by the database itself, not just by application code, so a bug in the app cannot leak one company’s rows to another. New tables inherit this automatically through a database trigger, so the protection cannot be forgotten on a future feature.
We verify it continuously. An automated tenant-isolation test proves company A cannot read or write company B’s data, and it runs on every single deploy. If isolation ever broke, the release would be blocked before it reached you.
Encryption everywhere
All traffic is encrypted in transit with TLS, and HTTP Strict Transport Security is enforced so browsers only ever connect over HTTPS. Data is encrypted at rest by our infrastructure providers.
On top of that, the access tokens for your connected accounts (the keys to the connection) are encrypted with AES-256-GCM before they are ever written to the database, using a key that is never stored alongside the data. Tokens are never written to logs.
Application security
Every request to a StashGrade API is authenticated, and then re-checked to confirm you own the specific company and record you are touching. Administrative and scheduled jobs are gated behind separate secrets and fail closed if those secrets are missing. Incoming webhooks (for example, from Stripe) are cryptographically signature-verified before we trust them, and every third-party connection validates an anti-forgery token to prevent connection hijacking.
Secrets never reach the browser: the keys that read your database live only on the server, never in the code shipped to your device. We scan the entire codebase and its history for accidentally committed secrets, check dependencies for known vulnerabilities, and run static analysis for unsafe data handling on every change. Standard browser hardening headers (content-type, framing, and referrer protections) are applied site-wide.
Payments, and why we never see your card
Billing is handled entirely by Stripe, which is certified PCI DSS Level 1, the highest level in the payments industry. Your card details are entered on Stripe’s own secure fields and go directly to Stripe.
StashGrade never receives, processes, or stores your full card number. That keeps your most sensitive payment data out of our systems by design.
What the AI sees, and what it never does
StashGrade’s AI reads your aggregated financials (revenue by account, job costs, overhead lines) to explain what your numbers mean. Analysis runs on Anthropic’s Claude through their commercial API, where your data is not used to train models. It is not shared with any public or shared model. Every analysis runs under hard per-company and per-user spend caps and rate limits that fail closed.
The AI is barred, by design and by automated tests, from giving financial, tax, or legal advice. It describes what your books show and the operational decision they point to. What you do with that stays between you and your accountant.
We check our own numbers
Because our entire value is showing you accurate figures, we reconcile our cached numbers against a fresh pull from your accounting system on a nightly schedule. If a closed month ever drifts from what QuickBooks now says (for example, after your bookkeeper restates something), we flag it internally and treat the affected figures as estimates until the next clean sync.
This data-integrity loop is not a typical SaaS feature. It exists so that a number on your dashboard is one you can act on, not one you have to second-guess.
Benchmarks are anonymous and opt-in
You are never in an industry benchmark unless you choose to be, in Settings. It is off by default.
When you opt in, your figures enter the benchmark pool under a one-way cryptographic identifier that carries no company name, customers, or transactions, grouped into broad cohorts (trade, region, and size band) of at least five companies so no single business can be singled out. Opt out anytime and your data leaves the pool.
Where your data lives, and what we keep
StashGrade runs on Vercel (application) and Supabase (database and storage), both certified SOC 2 Type II, with data hosted in the United States. We store the financial data needed to produce your scorecard and history, your account and team details, and the encrypted tokens for your connections. We do not store your card number or your QuickBooks password.
We keep your data for as long as your account is active so your trends and history stay intact, and we remove it on request or after account closure. See our Privacy Policy for the full detail.
Monitoring and incident response
We run automated health checks and capture application errors so problems surface quickly, and a self-healing audit runs nightly against the live site to catch anything that drifts after a deploy.
If a security incident ever affected your data, we will notify you promptly with what happened, what data was involved, and the steps we are taking. We would rather over-communicate than leave you guessing.
Security is checked on every deploy
Before any change reaches production, an automated security suite runs: forced row-level-security verification across every tenant table, the cross-company isolation test, secret scanning over the full history, dependency vulnerability checks, and static analysis for unsafe data handling. A red result blocks the release.
On top of that, the nightly audit re-runs the full battery against the live site, so coverage does not depend on anyone remembering to check.
Leaving, and deletion, are simple
Disconnect QuickBooks in Settings and the access token is revoked immediately. You can also revoke it from your Intuit account at any time. Your QuickBooks is exactly as you left it.
Ask us to delete your data and it is gone. Email [email protected] and we remove it. We can also provide an export of your data on request.
Who we rely on (sub-processors)
We build on a small set of established, independently audited providers rather than rolling our own. Each holds the certifications below, as published by the provider.
| Provider | Purpose | Certification |
|---|---|---|
| Intuit (QuickBooks) | Source of your accounting data; you authorize the read-only connection | SOC 2, ISO 27001 |
| Supabase | Primary database, authentication, and file storage | SOC 2 Type II |
| Vercel | Application hosting and content delivery | SOC 2 Type II |
| Stripe | Subscription billing and payment processing | PCI DSS Level 1, SOC 2 |
| Anthropic | AI analysis (Claude API); data not used for training | SOC 2 Type II |
| Resend | Transactional email (login codes, receipts, digests) | SOC 2 |
Our compliance posture, honestly
StashGrade is built on SOC 2 Type II certified infrastructure and follows secure-by-default engineering: least privilege, encryption, database-enforced isolation, and automated security testing on every release. We will not claim certifications we do not hold. Here is what we are actively working toward:
- Our own SOC 2 Type II examination (we are built on SOC 2 infrastructure today; our own report is in progress and will be available under NDA).
- An independent third-party penetration test ahead of broader scale.
- Optional multi-factor authentication and one-time-code (passwordless) login.
Security questions, or reporting an issue
Want a deeper review before you connect anything, or need a signed agreement for your procurement team? Email us first. If you believe you have found a vulnerability, report it to the same address and we will respond promptly; we will not pursue good-faith security researchers.
Email [email protected]StashGrade is operated by However We Got Here, LLC. See our Privacy Policy and Terms for data handling, retention, and your rights.