Reconciliation Sentinel

Privacy policy

Effective October 13, 2026.

Reconciliation Sentinel connects to a QuickBooks Online company so you can review reconciliation findings. This policy describes the information that connection uses. The end user license describes the terms of use.

Information from QuickBooks

When you connect a company, the app receives:

• The company name and QuickBooks company id.
• Accounting records needed for the review, including deposits, payments, purchases, bills, invoices, sales receipts, accounts, and the line items on those transactions.
• Webhook notices Intuit sends when records in that company change.

Information the app stores

• The QuickBooks access token and refresh token, encrypted, so the connection can continue until you disconnect.
• Findings from each review, category suggestions, and an audit log of changes you apply or mark resolved.
• Webhook payloads for the connected company.
• The name, email address, and message you send from the support form.
• A session cookie that remembers which company is connected, and a short-lived sign-in cookie that holds the OAuth state and proof key. Both cookies are httpOnly.

The app does not ask you to create a separate account, and it does not collect a password. It does not sell QuickBooks data and does not use it for advertising.

How the information is used

The data is used to show findings for the connected company, to explain a suggested category, and to write a change back to QuickBooks when you confirm it. A confirmed change is either a fee line on a deposit or a new expense account on a purchase or bill. The app reads and writes only the company in your session.

Who else processes it

The app is hosted on Vercel. Its database is hosted on Neon. QuickBooks data is sent back to Intuit when you apply a change. A support message is also emailed to the operator through Amazon SES when that delivery is configured. These providers process the data only to run the app. The app does not share the connected company’s books with other customers.

Disconnect and retention

Disconnect revokes the QuickBooks token and deletes that company’s connection and stored webhook rows. Audit findings and the audit log can remain so you still have a record of changes that were made. You can disconnect from the app, or from the app list inside QuickBooks.

Security

Tokens are encrypted with AES-256-GCM before they are stored. Production pages are served over HTTPS. Sign-in uses an authorization code with PKCE, and a failed token request is not retried.