Security

How Attachment Bundler protects your QuickBooks Online data and your account.

• Sign-in with Intuit (OAuth 2.0 + OpenID Connect); your Intuit multi-factor settings apply. We have no passwords.
• Single QuickBooks accounting permission (Intuit offers no read-only one); the code only performs read requests.
• Tokens encrypted at rest with AES-256-GCM; secrets live in Cloudflare's secret store, never in code.
• Attachments are streamed, never stored. Export metadata is deleted automatically after 72 hours.
• HTTPS only, strict Content Security Policy, CSRF protection, signed download links, session cookies marked HttpOnly/Secure/SameSite.
• Spreadsheet formula injection is neutralised in every CSV/XLSX index.
• Logs contain ids and counts only. Report a vulnerability to support@atesensoftware.com (subject “SECURITY”).