SheetsSync is built with security as a fundamental priority. This page details our compliance with QuickBooks and Google requirements, our security practices, and how you can manage your data.
Trust Indicators
QuickBooks Integration Compliance
OAuth 2.0 Implementation
SheetsSync uses Intuit's official OAuth 2.0 protocol for secure authentication:
- Authorization code flow with PKCE where supported
- Tokens kept on our servers only, never sent to the add-on
- Tokens encrypted at rest with AES-256-GCM, using a key kept outside the database
- Automatic token refresh before expiration
- Tokens deleted from our database on disconnect
- User passwords never reach our servers
API Scopes Requested
| Scope | Purpose |
|---|---|
com.intuit.quickbooks.accounting |
Read and write access to QuickBooks accounting data |
openid |
User identity verification |
Controlled Access: SheetsSync syncs data from QuickBooks to your sheet. With Two-Way Sync enabled (Pro), you can also push changes back to QuickBooks. All write operations require explicit user action — nothing is modified automatically without your control.
QuickBooks Webhooks
We implement QuickBooks webhooks to handle:
- App disconnection events (immediate token cleanup)
- Data change notices that trigger webhook sync
- Webhook signature verification using HMAC-SHA256
Google Workspace Compliance
Google APIs Used
- Google Sheets API for data writing
- Google Identity Services for user authentication
- Google Apps Script for add-on functionality
OAuth Scopes
| Scope | Purpose |
|---|---|
spreadsheets.currentonly |
Write to the current spreadsheet only |
script.container.ui |
Display sidebar and dialogs |
userinfo.email |
Identify the current user |
Infrastructure Security
Vercel Edge Network
- Enterprise-grade hosting platform
- Automatic DDoS protection
- Edge functions with automatic scaling
- Automatic HTTPS with TLS 1.3
Supabase Database
- Enterprise-grade managed PostgreSQL
- Row Level Security (RLS) policies
- Point-in-time recovery
- Automatic backups
Data Handling Practices
What We Store
All of it is stored in our database and travels encrypted over HTTPS. OAuth tokens are also encrypted at rest.
| Data Type | Why | Retention | Deleted By |
|---|---|---|---|
| User email, plan and Stripe IDs | Your account and subscription | Until deletion request | Email request |
| QB company ID, name and OAuth tokens | Connect to QuickBooks | Until disconnect/expiry | Disconnect |
| Sheet settings | Remember your sync setup | Until you remove the setup | Add-on or email request |
| Sync logs | Troubleshooting (counts and errors) | 180 days | Automatic |
| Two-way sync push logs (values sent and QuickBooks' reply) | Trace changes made in QuickBooks | Values and reply: 30 days. Rest of entry: until deletion request | Automatic (values); email request (entry) |
| QuickBooks change notices (record type and ID) | Trigger auto-sync | 30 days | Automatic |
| Stripe billing events | Apply each billing change once | Contents: 90 days. Event ID, type and status: until deletion request | Automatic (contents); email request (ID) |
What We Don't Keep
Records and reports pulled from QuickBooks (invoices, customers, payments, etc.) are not saved on our servers. During a sync they are:
- Fetched from QuickBooks API
- Processed in-memory on our serverless functions
- Written directly to your Google Sheet
- Not saved; only the record count is logged
Rows you push to QuickBooks with Two-Way Sync are the exception: the values sent and QuickBooks' reply are kept in the push log above for 30 days. Edits waiting to be pushed are queued inside your spreadsheet, not on our servers. Your QuickBooks password and card details never reach our servers.
Disconnect and Data Deletion
How to Disconnect
You can disconnect SheetsSync at any time through multiple methods:
Method 1: From the Add-on
- Open Google Sheets
- Click Extensions > SheetsSync > Settings
- Click "Disconnect QuickBooks"
Method 2: From Intuit Account Manager
- Visit accounts.intuit.com
- Sign in to your Intuit account
- Navigate to Security > Apps connected
- Find "SheetsSync" and click "Remove access"
Method 3: API Request
What Happens on Disconnect
- OAuth tokens immediately deleted from our database
- Connection record removed
- Sync settings preserved (in case you reconnect)
- Account, logs and billing records kept until you request deletion or their retention period above ends (see Opt-Out)
- Previously synced data remains in your Google Sheet
- No further API calls made to QuickBooks
Vulnerability Disclosure
We take security seriously. If you discover a security vulnerability, please report it responsibly:
Security Contact
We aim to respond within 24 hours and will keep you updated on remediation progress.
Compliance Certifications
| Standard | Status | Coverage |
|---|---|---|
| Infrastructure Security | Enterprise-grade (Vercel & Supabase) | Hosting & database |
| GDPR | Compliant | Data handling |
| CCPA | Compliant | California users |
| Intuit Partner Guidelines | Compliant | QuickBooks integration |
Contact
For compliance questions, data requests, or security concerns:
- Security Issues: support@getsheetssync.com
- General Inquiries: support@getsheetssync.com
- Privacy Requests: privacy@getsheetssync.com