How we protect your books.

Access to your accounts

• We do not change your books. Intuit grants its accounting permission. BalanceSheets uses it to read financial data and does not post, edit, or delete entries.
• We never see bank passwords.Bank connections go through Plaid. You sign in to your bank inside Plaid's window; we receive an access token, not your credentials.
• Sign-in is through Google.We do not store passwords at all. Your Google account's security (including two-factor authentication) protects your BalanceSheets login.
• Disconnect anytime. Removing QuickBooks or a bank from Settings deletes the access token immediately. You can also revoke access from your Intuit account or through Plaid.

Encryption

• Tokens at rest. QuickBooks and Plaid access tokens are encrypted with AES-256-GCM using a key that lives only in our server environment, never in the database or in code.
• In transit. All traffic between your browser and BalanceSheets, and between BalanceSheets and Intuit, Plaid, Stripe, and our other providers, uses TLS.
• Database. Your data is stored in a Neon Postgres database that is encrypted at rest by the provider.

Keeping accounts separate

• Every record is tied to your organization. Every page and API route checks that the signed-in user belongs to the organization whose data is being requested.
• Team members you invite only see your organization. Roles limit what they can change.
• Shared report links show one report, read-only, and can be turned off from the report.

Payments

Card details go straight to Stripe. We never receive or store your full card number. Stripe is PCI DSS Level 1 certified.

Monitoring and response

• Errors are reported to Sentry so we can find and fix problems quickly.
• API routes are rate limited to slow down abuse.
• If we learn of a security incident affecting your data, we will tell you promptly by email with what happened and what we are doing about it.

What we do not have yet

We do not currently hold a SOC 2 report or ISO 27001 certification. We are not going to put a badge on the site until we have one. If your accountant or lender needs a specific security questionnaire filled in, email us and we will answer it honestly.

Your data is not for sale

We do not sell your financial data, share it with advertisers or data brokers, or use it to train AI models. It is used to run your account and nothing else. See the privacy policy for the full list of providers that process it.

Report a vulnerability

If you find a security problem, email hello@balancesheets.comwith the subject “Security report.” We read every message, will reply within two business days, and will not take action against good-faith research.

Updated October 29, 2026.