Skip to content
Book a demo
Security

Incident response and recovery

If something goes wrong with the security or availability of AI Bookkeeper, this page says who handles it, how fast, and how you will hear about it. It exists because the Intuit Developer Terms require prompt remedial action and prompt notification, and because a commitment nobody has written down is not a commitment.

Reporting a security issue

Report security issues to security@aibookkeeper.com, with "Security" in the subject line.

Tell us what you found, how to reproduce it, and when you saw it. We will confirm receipt before we have an answer, so you are not left wondering whether the report landed.

Who owns the response

Prabhakaran Annamalai is the named incident owner and owns each incident from report to closure; Venu is the deputy.

AI Bookkeeper is a small team, so both are reachable directly at security@aibookkeeper.com, including out of hours — this is not a queue that routes to nobody. Intuit's Developer Terms make the developer responsible for all user and technical support.

How quickly you will hear

We acknowledge a reported security issue within one business day.

If a confirmed breach affects your data, we notify you within 72 hours of confirming it, consistent with the GDPR standard.

Intuit is notified of any security incident without delay, as the Developer Terms require, independently of what we owe customers.

Recovery and continuity

Automated backups run daily (21:00 UTC) and are retained for 7 days, held by Google Cloud in the us-central1 region. Point-in-time recovery is enabled, with 7 days of transaction logs, so the database can be restored to any moment in that window — by provisioning a fresh instance from a backup or to a point in time.

Our recovery point objective is a few minutes — the gap to the last archived transaction log. Our recovery time objective is under an hour.

Your accounting platform is the system of record and it is not ours to lose. QuickBooks Online holds your books; AI Bookkeeper holds the first pass and the audit trail over it.

Vulnerability assessment

We run a vulnerability scan every month and remediate what it finds. Dependency and container-image scanning run automatically on every build, so a newly disclosed vulnerability in something we depend on surfaces without waiting for the monthly cycle.

We permit Intuit to run vulnerability scans within two weeks of request, or to supply recent reputable scan results, and to remediate what either finds — this is a standing obligation under the Developer Terms, not a one-off for review.