Security
How CanopyDecks protects your books
Your accounting data is some of the most sensitive information your organization holds. Here is exactly how it is handled, including what we have not built yet.
Read-only access to QuickBooks
CanopyDecks only reads your accounting data. It never creates, changes or deletes anything in your QuickBooks company. Disconnect at any time from Settings, which revokes our access with Intuit and deletes the stored connection.
Encrypted connection credentials
The credentials that let us read your QuickBooks company are encrypted with AES-256-GCM before they are stored, using a key kept separately from the database. A copy of the database alone cannot be used to reach anyone's books.
Every organization kept apart
Separation between organizations is enforced by the database itself, not only by application code, so one organization's data cannot be returned to another, even by a mistake in a query.
Encrypted in transit
Every connection to CanopyDecks uses HTTPS, and browsers are instructed never to connect without it.
AI commentary, handled with care
Commentary is written from computed totals, never from individual transactions. Donor, vendor and grant recipient names are removed before anything is sent, every figure in the text is checked against your books, and your data is not used to train AI models.
You stay in control
Delete any packet at any time, along with the files behind it. Ask us to delete your organization's data entirely and we will, and confirm when it is done.
Where your data lives
CanopyDecks runs on established cloud providers based in the United States, each used only to provide the service. They are named in our privacy policy.
What we have not done yet
Said plainly, so you can weigh it rather than discover it.
Multi-factor sign-in
Coming soonSign-in today uses your email address and its verification. A second factor, such as an authenticator app, is next.
SOC 2 report
Not yetWe are a new company and have not been through a SOC 2 audit. If your organization requires one, tell us.
Independent penetration test
Not yetNo outside firm has tested CanopyDecks yet. The protections above are what we can describe accurately today.
Questions, or something to report?
Email us about a security question, a concern, or anything that looks wrong. We read every message.
canopydecks@gmail.com