How we protect your prospects' financial data

Sajentic handles confidential financial data on behalf of CPA firms. Here is how we protect it at every step.

Encryption at rest

QuickBooks access and refresh tokens and the raw financial data pulled during a review are encrypted at rest using AES-256-GCM before they are ever written to storage. Decryption keys are managed separately from the data and are never logged.

Hard tenant isolation

Every firm's data is isolated at the database level using row-level security (RLS). A query running under one firm's credentials cannot read or modify another firm's records — this is enforced by the database itself, not just by application code.

MFA required on every account

All Sajentic accounts require multi-factor authentication. Every sign-in must complete an MFA challenge with a TOTP authenticator app before access is granted. There are no exemptions — including for firm owners and platform administrators.

If someone loses the phone that holds their authenticator, they can reset it by email. That reset is held for 24 hours before it can take effect. During the hold, the account holder is emailed with a one-click cancel option, every signed-in session on the account shows a cancel banner, and when a firm member makes the request, the firm's owner is notified and can cancel it. Completing the reset removes the old authenticator, signs out every other session, and requires setting up a new authenticator before the account can be used.

Append-only audit trail

All access to firm data, authentication events (including authenticator resets), QuickBooks token issuance and revocation, and report generation are recorded in an append-only, hash-chained audit log. Entries cannot be modified or deleted — any tampering is detectable.

QuickBooks connection revoked after the pull, raw data deleted after the analysis

An in-process cleanup runs in two steps:

As soon as the data pull finishes, Sajentic explicitly revokes the QuickBooks connection with Intuit. The refresh token is the one revoked, which terminates the authorization itself, and both the access and refresh tokens are deleted from our systems.
When the analysis finishes, the raw financial data pulled for the review is deleted.

We keep the report: the score, the findings with their evidence, the quote, summary financial statements, and balances owed by and to customers and vendors, encrypted until you delete the submission. The raw data pulled from QuickBooks is deleted.

Cleanup is primary in-process, with a daily safety-net job as a backstop: it sweeps any session whose in-process cleanup did not run, revoking the token and purging the data. A configured retention window is the authoritative upper bound on how long raw data can persist.

The prospect never has an account

The business owner whose books are reviewed never holds a Sajentic account or credential. They interact only through the unauthenticated public portal and have zero access to your firm's data, reports, or settings.

If you have security questions or concerns, contact support@sajentic.com.