Security & Data Protection
Your data is encrypted in transit with TLS and at rest by Google Cloud Platform using AES-256. 2diff Business connects to QuickBooks® Online through Intuit's OAuth 2.0 sign-in, so we never receive your QuickBooks password, and it only reads your reports: it never creates, changes or deletes anything in your books.
How does 2diff.io protect my financial data?
2diff Business runs on Google Cloud Platform infrastructure, which is independently audited under SOC 2 Type II.
Our security architecture is designed to protect your data at every stage: during transmission, at rest, and throughout processing. We employ industry-standard encryption protocols, secure authentication mechanisms, and strict access controls to ensure your information remains private and protected.
How does 2diff Business sign in to my books?
OAuth 2.0 Authentication
Industry-standard authentication protocol used by major financial institutions. Your credentials are never stored on our servers.
We Only Read Your Data
Our applications retrieve data for analysis. We never modify, delete, or create transactions in your accounting system.
Session Management
Sign-in runs through Firebase Authentication, which issues short-lived sign-in tokens that refresh automatically. You stay signed in on a device until you sign out, so sign out on shared devices.
How is my financial data encrypted?
In Transit
All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (Transport Layer Security). This ensures that your financial information cannot be intercepted or read by third parties during transmission.
At Rest
Our systems are built on Google Cloud Platform infrastructure, and data stored in them is encrypted at rest by Google Cloud Platform using AES-256. Even in the unlikely event of a data breach, encrypted data remains unreadable without the encryption keys.
Token Security
OAuth credentials and access tokens carry an additional application layer of authenticated encryption on top of the platform encryption above, and are automatically rotated to minimize exposure risk.
How is the infrastructure protected?
Cloud-Native Architecture
Built on Google Cloud Platform infrastructure, which is independently audited under SOC 2 Type II and carries redundancy and compliance certifications of its own. Your account data, entered figures and cached reports are stored in Google Cloud us-central1 (Iowa, United States).
Network Protection
Traffic reaches our services through Google Cloud's front end, which carries Google's default DDoS protection, and our sign-in, form and AI endpoints enforce rate limits.
Secure Development
Our development practices follow OWASP guidelines, with input validation and parameterized queries. Application code changes merge through a pull request, and our backend tests and automated checks run before each push.
Activity Logging
Google Cloud records administrative changes to our project, such as permission changes and deployments. Our backend logs API activity, connection and security events for 90 days, and billing events for 365 days. Financial data in our Firestore database is isolated at the user ID and company ID level at the database layer. No user can access another user's data even if authenticated.
Incident Response
In the event of a confirmed data breach affecting your personal information, we will notify affected users within 72 hours of becoming aware of the incident. Notification will describe the nature of the breach, data categories affected, and remediation steps taken. Our incident response procedures include immediate containment, root cause analysis, regulatory notification where required, and post-incident review.
Where is my data stored?
Your account data, entered figures and cached reports are stored in Google Cloud us-central1 (Iowa, United States). When you use an AI feature, your request is processed by the provider you select under its own API terms, as described in our Privacy Policy. Where we store your data:
- Cloud infrastructure: Google Cloud Platform, us-central1 region (Council Bluffs, Iowa, United States)
- Database: Google Cloud Firestore, us-central1 region
- Compute: Cloud Run, us-central1 region
- Data isolation: Each user's financial data is stored in a separate Firestore document path keyed to their user ID and company ID. Database-level rules enforce that no user can read or write another user's documents.
If you are an EEA, UK, or Swiss resident and have questions about cross-border data transfers, see our Privacy Policy or contact info@2diff.io.
Which third-party services handle my data?
QuickBooks® Online Integration
Our 2diff Business application integrates with QuickBooks® using Intuit's OAuth 2.0 API. This means:
- You authorize the connection directly through Intuit's secure authorization flow
- Intuit's one accounting permission: Intuit offers apps one accounting permission that covers reading and writing. 2diff Business only reads, and never creates, changes or deletes anything in your books.
- Tokens are short-lived and automatically refreshed when needed
- You can revoke access at any time through your Intuit account settings
Payment Processing
Payment information is processed through Stripe, a PCI-DSS Level 1 certified payment processor. We never see or store your full credit card number.
Every third party that handles your data
Our sub-processor list names every third-party service that processes data for us, including hosting, payments, sign-in, and the AI providers, with what each one receives.
What will you never do with my data?
We believe transparency about our limitations is just as important as highlighting our capabilities:
- We never sell your data to third parties
- We never share your financial information with advertisers or marketing companies
- We never use your data to train AI models: financial context you choose to send to an AI provider (OpenAI, Anthropic, Google) is handled under that provider's API terms, which state it is not used for training and which set how long the provider keeps the request; see our Privacy Policy
- We never store credit card numbers on our servers
- We never make changes to your accounting records
Which security standards apply?
SOC 2 Infrastructure
Our cloud infrastructure provider maintains SOC 2 Type II compliance for security, availability, and confidentiality.
PCI-DSS Payments
Payment processing through Stripe meets the highest level of PCI-DSS compliance for cardholder data protection.
HTTPS Everywhere
All connections to our services require HTTPS. We never transmit data over unencrypted connections.
Security Audits
We run security audits of our code and infrastructure and keep a dated written record of each. Dependabot opens monthly dependency-update pull requests.
What control do I have over my data?
You maintain full control over your data:
- Disconnect anytime: Disconnect QuickBooks from inside 2diff Business at any time; our access ends and your cached financial data is deleted at once
- Data deletion: Ask us by email to delete your account; our Privacy Policy lists what we delete and the records we must keep
- Data export: Download your statements from the app while your subscription is active, or ask us by email for a copy of your data
- Transparency: View exactly what data we access and how it's used
How do I report a security concern?
For security inquiries or to report a potential vulnerability, please contact us at info@2diff.io.
See It In Action
Try 2diff Business with sample data and see our security approach firsthand. No credit card or QuickBooks connection required.