Security and your data
Plain answers to the questions an owner and an accountant ask before they let anything near the books.
Where does our data live?
In a database that is yours alone — one isolated database per customer, hosted in the United States on Railway, with point-in-time backups. No customer shares a database with another customer.
How is QuickBooks reached?
Through Intuit's own QuickBooks Web Connector, running on your machine, next to your QuickBooks file. It polls us; we never reach into your network, and we never hold your QuickBooks login.
What can be written to QuickBooks?
Only what an allow-list permits, one kind of document at a time, through a single audited door. An admin holds a switch that stops every write, and a log records what crossed and when. Any change built on a stale reading of QuickBooks is refused rather than overwriting someone's work.
Does the AI assistant touch our books or our data?
It drafts documents for a person to review, using only what that person is already allowed to see. It cannot write to QuickBooks. When a person asks it something, the question and the relevant records are sent to Anthropic's API to produce the draft; nothing is used to train models.
Who can sign in?
Your people, through Google sign-in on your own domain, with permission levels set per person. Microsoft 365 sign-in is on the roadmap.
Is everything encrypted?
Yes in transit — every connection uses TLS, including the Web Connector's. Databases and file storage are encrypted at rest by the hosting providers.
What happens if FlyoverOS disappeared tomorrow?
Your QuickBooks file is current and yours — every invoice and payment already crossed into it. Export rights for everything else are written into the customer agreement.
What don't you have yet?
A SOC 2 report. We are a small company built inside a working business; we run the practices above and will say plainly what we do and don't have.