Security

Security is fundamental to Reconci AI. We handle sensitive financial data and QuickBooks credentials on behalf of our users, and we take that responsibility seriously. This page describes the security measures we have in place.

Data Encryption

In transit

All communication between your browser and our servers is encrypted using TLS 1.2+. All API calls to QuickBooks Online, Resend, and AI providers are made over HTTPS.

At rest

Your QuickBooks OAuth access and refresh tokens are encrypted using AES-256-GCM with a per-deployment encryption key before being stored in our database. The encryption key is stored as an environment variable, never in source code or version control.

Passwords are hashed using bcrypt with a cost factor of 10. Plain-text passwords are never stored, logged, or transmitted after the initial hashing step.

Authentication & Sessions

• Sessions are managed via short-lived JWT tokens (14-day expiry) stored in an HttpOnly, SameSite=Lax, Secure (in production) cookie.
• The JWT signing secret is stored as an environment variable and rotated per deployment.
• QuickBooks OAuth uses a CSRF state token validated on callback to prevent open-redirect and CSRF attacks.
• OAuth state tokens expire after 10 minutes.

Infrastructure

• The application is deployed on Vercel's edge infrastructure.
• The database runs on a managed provider with encrypted storage and automated backups.
• Environment secrets are managed via Vercel's encrypted environment variable store.
• Source code is stored in a private repository and never contains hardcoded secrets.

QuickBooks Integration Security

• We use Intuit's official OAuth 2.0 authorization code flow. We never ask for or store your QuickBooks username and password.
• OAuth tokens are refreshed on demand and encrypted before storage. Expired tokens are never used.
• You can revoke our access to QuickBooks at any time from your Intuit account settings. Reconci AI detects a revoked token on the next sync and prompts you to reconnect.

AI Provider Data Handling

When AI categorization is enabled, transaction details (vendor name, amount, memo, date) are sent to our configured AI provider (Google Gemini or Groq) over HTTPS. We send the minimum data required for categorization. We do not send account numbers, full legal names, or sensitive PII to AI providers.

Receipt images (when used for multimodal categorization) are sent as base64-encoded data in HTTPS request bodies and are not retained by Reconci AI after the API response.

Responsible Disclosure

If you discover a security vulnerability in Reconci AI, please report it responsibly to security@reconci.ai before disclosing it publicly. We will acknowledge receipt within 48 hours and work to resolve confirmed issues promptly.

Contact

For security-related questions or to report a vulnerability, contact us at security@reconci.ai.

See also our Privacy Policy and Terms of Service.