Security & trust
SyncMate Pro holds your clients' books. Here is exactly how we protect them: no buzzwords, just what the system does.
Access is enforced by the database
- Every table is protected by rules in the database that check which organization each person belongs to and their role. A screen cannot show what the database will not return.
- Four roles: owner, super admin, admin and member. A firm's admins and members see only the clients they are assigned.
- Only an owner or admin can connect or disconnect a client's QuickBooks Online, BQE Core or Harvest.
- A browser left without activity is signed out: after 1 hour, or after 1 to 4 hours as the organization chooses. An organization can require its time for everyone on its team.
Connections to your books
- Connection tokens for QuickBooks Online, BQE Core and Harvest are stored encrypted in Supabase Vault, read only by our servers, and never sent to your browser.
- QuickBooks Desktop is reached through the QuickBooks Web Connector on your own computer. Its password is shown to you once; we keep only a one-way hash.
- Information travels over encrypted connections.
AI agents, on a leash
- An agent signs in as you and can do only what you can.
- Every change an agent wants to make is shown to you first and applied only when you approve it.
- Every change it makes, or tries to make, is recorded on the organization's Agent activity page. An owner or admin can pause agents in one click.
Your books, protected from mistakes
- A reconciled period is locked in the database. Only an owner or admin can reopen it, and they must give a reason.
- After a period is reconciled, SyncMate Pro watches QuickBooks Online for changes to it and tells the owners and admins.
- Every line carries its own ID, checked against what the books already hold before anything is sent, so a line already posted is not posted again.
- Deleting from QuickBooks is limited to the owner and admins the owner allows, never touches a reconciled entry, and a copy of each entry is recorded before it is deleted.
A complete record
- Who did what, and when, for people and agents alike. The time and the person are stamped by the server, not the browser.
AI and your data
- Statement text and check images are read by Anthropic's Claude models. Transaction descriptions are sent to Google's Gemini models, through Lovable's AI gateway, to suggest categories.
- We send only what the task needs, and we do not train our own AI models on your information.
- Read the full details in our Privacy Policy.
Who gets in
- SyncMate Pro is in private beta: every new firm or business is reviewed by our team before it opens.
Found a security issue? Email support@syncmatepro.com.