Security & data handling
Plain answers about what CoController AI stores, how it is protected, and how you get it deleted.
Plain answers about what CoController AI stores, how it is protected, and how you get it deleted. Where the honest answer is "this is a process, not a feature", we say so.
How we connect to QuickBooks
CoController connects through Intuit's standard OAuth. You sign in with your own Intuit login and choose which company to connect — we never see or store your QuickBooks password, and we never read bank-feed credentials.
How your tokens are stored
- Your QuickBooks OAuth tokens are stored server-side only, encrypted with AES-256-GCM (a 32-byte key) in Cloudflare KV, with a fresh random IV for every stored record.
- Your browser holds nothing but a random session ID, in a cookie flagged HttpOnly, Secure and SameSite=Lax. Raw tokens never reach the browser, and the Chrome extension works the same way: it presents the session ID and the server resolves the tokens.
- Each connected company has its own separately stored, encrypted token record, keyed by that company's QuickBooks realm ID. Companies do not share tokens or workspaces.
Your account
- Passwords are hashed with PBKDF2-HMAC-SHA-256 at 100,000 iterations, with a random per-user salt. We store the salt and the hash — never the password.
- Account sessions run in a signed, HttpOnly cookie and expire after 30 days; signing out destroys the server-side session record.
Approval controls — what "nothing posts automatically" means, precisely
- CoController prepares; it does not post. Categorisation suggestions, journal entries and bill creations are drafts until you approve them.
- Before any write, the target account is validated against your live chart of accounts, and the transaction is re-read from QuickBooks so a stale copy can never be overwritten. Writes carry an idempotency key so a retried request cannot double-post.
- Journal entries must balance — debits equal to credits — and are rejected by the server if they do not.
- The AI assistant can only draft proposals. It has no path to post on its own.
- One deliberate, opt-in exception, and it still cannot post: per client, you may switch on "Auto-approve learned ≥95%". Rows learned from your own books at 95% confidence or higher are then marked approved in the app when live data loads. Each auto-approval is audit-logged and can be undone, and posting to QuickBooks remains a separate action that only you take.
Audit trail
- The app keeps an audit log per company — suggestions, approvals, auto-approvals, postings and framework changes, each timestamped — viewable in the app and included in workpaper exports.
- Decision-queue records (what was suggested, approved or dismissed) are held server-side; resolved items are retained for 90 days.
Where your data lives
- On our servers (Cloudflare): your account record, your company registry, your encrypted QuickBooks tokens, and the assistant's queue, chase and learned-pattern records — all keyed per account and per company.
- In your own browser: the Close Center's working data — checklists, categorisation state and the audit log — is stored in your browser's local storage on your machine. Clearing the site's browser data deletes it; we cannot delete what we do not hold.
- Free tools: the free tools (statement converter, W-9 request, 1099 check, payout explainer, nexus tracker, cash-flow forecast, pricing calculator) run in your browser; files you open in them are not uploaded to our servers.
- Location: our hosting and storage run on Cloudflare’s global network. We do not pin stored data to a single country, and we do not offer a data-residency guarantee.
Email we send on your behalf
Client chase emails are sent through Resend from CoController AI <[email protected]>. A chase sends the client's name and email address, your company name, and the name of the document being chased. Chases send at most 3 emails per item, never more often than one every 3 days, and only after you start or approve the chase.
Payments
Subscriptions are handled by Lemon Squeezy as merchant of record. Your card details are entered on Lemon Squeezy's checkout and never touch our servers; we receive your subscription status and tier so the app can apply your plan.
Subprocessors
| Provider | What it does | What it receives |
|---|
| Intuit / QuickBooks Online | Your ledger, via the official API | Accounting data, only with your OAuth consent |
| Cloudflare | Hosting, infrastructure, encrypted token and record storage | The server-side records described above |
| Lemon Squeezy | Payment processing, merchant of record | Billing details and subscription status |
| Resend | Transactional email delivery | Chase email recipients and content (names, company, document names) |
Retention & deletion
- Disconnect a company at any time (QuickBooks → Apps → My Apps → CoController AI → Disconnect, or in the Close Center). We revoke that company's tokens at Intuit, delete our stored copies, and remove the company from your registry. Your other connected companies are untouched.
- Delete everything: email [email protected] with the subject "Delete my data". We permanently delete your workspace data, including tokens and cached company data, within 30 days and confirm by email.
- Categorised results and checklists held in your browser persist until you clear them (see "Where your data lives").
Access controls
Your account password is stored as a salted PBKDF2-HMAC-SHA-256 hash (100,000 iterations), never in plain text. Account sessions use an HttpOnly cookie carrying a random session ID, and your QuickBooks access tokens are never sent to your browser — they stay encrypted on our servers (AES-256-GCM). Every change CoController makes in QuickBooks requires your explicit approval and is written to an audit log. Operational access to production systems is limited to the founding team.
If something goes wrong
If we learn of a security breach affecting your data, we will notify you promptly by email, as set out in our privacy policy.
Contact
Questions about security or privacy: [email protected]. This page describes the product as it works today; when the implementation changes, this page changes with it.