Security, in plain sight.

What we encrypt, where we store your financial data, and who can access it.

Your books are never sold or used to train AI. No ad trackers. No session recordings. Contractor tax IDs and bank connection tokens get an additional layer of encryption.

Updated November 2026

escbooks / controls

in transit: TLS 1.2+, HTTPS only
at rest: AES-256
contractor tax IDs: encrypted again
bank logins: never seen
sign-in: two-step
isolation: row-level security
stored in: United States
ads and trackers: none
AI: only if you connect it

Encryption

Protected on the wire, on disk, and once more where it matters most.

In transit: Every connection is encrypted with TLS 1.2 or newer, and browsers are told to reach EscBooks over HTTPS only (HSTS).
At rest: The database, your files and every backup are encrypted with AES-256.
Contractor tax IDs: Encrypted a second time in the database, with their own 256-bit key kept in a secrets vault. Only the last four digits show, and every look at a full number is recorded.
Bank connection tokens: Encrypted the same way. They never reach your browser, your accountant or an assistant.
Receipts and statements: Kept in private storage. A link to open one expires after five minutes.
Card numbers: Entered in Stripe's own fields and held by Stripe. EscBooks keeps the card's brand and last four digits, nothing more.

Sign-in and access

Your password is only the first lock.

Passwords: Stored only as salted hashes. No one at EscBooks can read yours.
Two-step verification: Add an authenticator app, and the database itself refuses any change to your books until the code is entered.
Confirm it's you: Changing your password or two-step, downloading a backup, inviting someone or changing what an assistant may do asks you to prove it's you again.
Sessions: See every device that's signed in, and sign any of them out. Signing out takes effect at once.
Sign out when away: Optional automatic sign-out, from 15 minutes to 8 hours.
Security emails: A new sign-in, or a change to your password, email, two-step or payment details, is emailed to every owner. These can't be turned off.
Recent Activity: A running record of sign-ins and sensitive changes, with who made each.

Isolation

Each business is walled off in the database itself, not just in the app.

Row-level security: On every table. The database checks each request against the business it belongs to, so one account can't read or change another's records.
Tested: Automated tests check every table for it, and try to cross from one business into another, each time the code changes.
Accountants: Invited by the owner, read-only, and removable at any time. They propose a change; the owner approves it.
EscBooks staff: No one at EscBooks signs in as you: there is no impersonation feature. Our own console shows counts and plan status, never the contents of your books.

Privacy

EscBooks uses your data to keep your books. That's the whole list.

Advertising: None. No ad networks, no personalized ads, and nothing shared for advertising.
Trackers: No ad trackers, no pixels, and no recordings of what you click or type.
Analytics: Visits are counted with Cloudflare's cookie-free analytics. Nothing follows you to other sites.
Your data: Never sold. Never used to market to you or to your clients.
AI training: Your books are never used to train AI.
Legal requests: If anyone asks us for your data, we tell you first, unless the law forbids it.
In full: The Privacy Policy, and what other accounting companies' policies allow.

Your books are never a data point.

QuickBooks is moving accountants to a new suite that's adding tools to compare finances across their clients. EscBooks has no such tool, and won't build one.

“Compare financial data across your client portfolio and ask detailed questions to get real-time insights.”

Intuit, "Update from QuickBooks Online Accountant to Intuit Accountant Suite", listed as coming soon. Read November 2026.

Pooling: No screen adds up figures across an accountant's clients.
Comparison: No client is ranked, scored or benchmarked against another.
The client list: An accountant's list of clients shows where the work stands. It carries no revenue, no balances and no figures from anyone's books.
Whose choice: Each client grants access to their own books, and can end it at any time.

QuickBooks and Intuit are trademarks of Intuit Inc. EscBooks is not affiliated with or endorsed by Intuit.

Infrastructure

No servers of our own, and one country for your books.

Cloudflare: EscBooks runs on Cloudflare's network. There are no EscBooks servers to patch, expose or forget about.
DDoS protection: Always on, at Cloudflare's edge, before traffic reaches the app.
Delivery: Pages are served from the Cloudflare location nearest you.
Attestations: Cloudflare maintains SOC 2 Type II, ISO 27001 and PCI DSS Level 1, listed on its Trust Hub.
In the browser: EscBooks can't be framed by another site, and the browser will run scripts only from EscBooks, Stripe, Plaid and Cloudflare.
The company: EscBooks was founded and is headquartered in Houston, Texas.
Where it's stored: Your books and files are stored in the United States.

Bank connections

Linked through Plaid, and never required.

Sign-in: You sign in to your bank in Plaid's own window. EscBooks never sees or stores your bank username, password or security codes.
Read-only: A connection reads balances and transactions. It can't move money.
What EscBooks keeps: The account's name, type and last four digits, its balance and its transactions. They are your books, so they live in your books.
The connection: Plaid's access token is stored encrypted and never leaves the server.
Disconnect: Any time. The token is deleted, along with any lines you hadn't brought into your books.
No link at all: Type transactions in, or import your bank's own download. Nothing in EscBooks depends on a bank link.

AI is optional

Every feature works without AI. If your books have to stay clear of it, they can: an assistant gets in only if you connect one.

By default: No AI. EscBooks itself calls no AI model, for any feature.
Sorting transactions: Deterministic rules, not model inference. Same line in, same answer out, and nothing leaves EscBooks to be classified.
Your corrections: Change a line once and EscBooks saves it as a rule for your books alone. Every rule is yours to see, edit or delete, and none are shared between businesses.
Plaid's categories: A bank feed line can arrive with Plaid's own category. It's shown as a suggestion, after your rules.
If you connect one: You choose the assistant and exactly what it may do. EscBooks receives its requests, never your conversation.
Money: Sending an invoice or recording a payment waits for your approval in EscBooks.
On the record: Everything an assistant changes is logged with what was there before, and can be undone.
Out of reach: Bank credentials, connection tokens, tax ID numbers and your settings.
Off: One click ends a connection, from its very next request.

Reporting and response

Found something? Tell us.

Report a vulnerability: Write to security@escbooks.com. Every report is acknowledged within two business days.
If something goes wrong: If your data is ever affected, we tell you without unreasonable delay.
Your own copy: Download a full backup of your books whenever you like.
Deletion: Ask, and your account and its data are deleted within 30 days.
Review: Our written security policies are reviewed at least once a year.

A question we didn't answer?

Write to security@escbooks.com.

Join the Beta