Guide

Is it safe to connect QuickBooks or Xero to an AI tool? A checklist

It can be, if the tool answers six questions in writing. What permission does it request? Does it ever write to your books? Is your data used to train AI models? Where is it stored, and for how long? Can you revoke access, and how? What happens to your data when you leave? Xero offers granular read scopes; QuickBooks Online offers no read-only accounting scope, so there the safeguard is what the tool does with its access.

Updated October 16, 2026

What should you ask before connecting your books to an AI tool?

Ask what permission the tool requests and what it does with it, whether it ever writes to your books, whether your data trains its models, where the data is stored and for how long, how you revoke access, and what happens to your data when you leave. Ask for each answer in a published policy, not a sales call.

What permission does it request? Your ledger shows the list on its consent screen when you connect. Xero offers granular scopes, one per kind of record or report, so a tool that only reads can ask for read scopes alone. QuickBooks Online offers no read-only accounting scope: every app gets the same accounting permission, which technically allows reading and writing. With QuickBooks Online the real question is what the tool does with it.
Does it ever write to your books? Posting journal entries, editing or deleting transactions, creating invoices or bills, closing a period or moving the closing date. A reporting or analysis tool needs none of these. Ask the vendor to say plainly that it never writes, and what stops its own code if it tries.
Is your data used to train AI models? Ask about the vendor and about the model provider it sends your figures to: does either use them to train or improve a model, and how long does the provider keep what it receives?
Where is it stored, and for how long? The country, the companies that host the application and the database, whether the data is encrypted at rest, and how long each kind of data is kept. A published sub-processor list names every company that handles your data.
Can you revoke access, and how? You can always end the connection from the ledger's side, without asking the vendor. Disconnecting stops new reads; it does not by itself delete what the tool has already copied.
What happens to your data when you leave? Whether you can export it, how many days it is kept after you cancel, and whether it is then deleted. Ask for the number of days, in writing.

The checklist, ready to copy

Send it to the vendor before you connect anything, and keep the answers with the links they point to. A good answer names the mechanism and the document; a warning sign is a promise with nothing behind it.

Question	A good answer	A warning sign
What permission does it request?	Lists the exact scopes. On Xero, read scopes only; on QuickBooks Online, says the permission allows writes and that the tool only reads.	Says the QuickBooks Online permission itself stops it from writing.
Does it ever write to your books?	Never posts, edits or deletes anything, and a write attempt is blocked.	"Two-way sync" in a tool that only reports.
Is your data used to train AI models?	No, by the vendor or by its model provider, in published terms.	"We may use your data to improve our services", with no exception for model training.
Where is it stored, and for how long?	The country, encryption at rest, a sub-processor list and a retention period for each kind of data.	No sub-processor list; data kept "as long as necessary".
Can you revoke access, and how?	Disconnect from the ledger at any time; the vendor says what it keeps afterwards.	It asks for your accounting login and password instead of the ledger's own connection.
What happens to your data when you leave?	An export, then deletion after a stated number of days.	No export, and no date for deletion.

AI tool safety checklist plain text

AI TOOL SAFETY CHECKLIST - [Tool] - [Date]
For an AI tool that connects to Xero or QuickBooks Online.

1. PERMISSION   Which scopes does it request?
                Xero: read scopes only? QuickBooks Online: the permission
                allows writes, so what does the tool do with it?
                Answer: [ ]   Source: [link]

2. WRITES       Does it ever post journal entries, edit or delete
                transactions, or close a period?
                Answer: [ ]   Source: [link]

3. TRAINING     Is your data used to train or improve AI models, by the
                vendor or by its model provider?
                Answer: [ ]   Source: [link]

4. STORAGE      Where is your data stored, is it encrypted, and how long
                is each kind of data kept?
                Answer: [ ]   Source: [link]

5. REVOKING     How do you disconnect it, and what stays with the vendor
                afterwards?
                Answer: [ ]   Source: [link]

6. LEAVING      Can you export your data, and after how many days is it
                deleted once you cancel?
                Answer: [ ]   Source: [link]

Why is there no read-only permission for QuickBooks Online?

Intuit publishes one accounting permission for QuickBooks Online, and it covers both reading and writing. An app that only reads your books has to request the same permission as one that posts entries, so the token it holds could write. Whether it ever does is decided by the app's own code, which is why its written answer matters.

The permission is called com.intuit.quickbooks.accounting, and it is the one Intuit offers every app that connects to your company's books. Xero works differently: it offers granular scopes, a read scope and a read-and-write scope for each kind of record or report, such as accounting.invoices.read for invoices. A tool that only reads can ask Xero for read scopes alone.

So on Xero, check the scopes on the consent screen; on QuickBooks Online, check what the vendor says it does with the permission, and where it says so.

How do you revoke an AI tool's access to Xero or QuickBooks Online?

From the ledger itself, at any time. In Xero, open Settings, then Connected apps, and disconnect the app. In QuickBooks Online, an admin opens Integrations, then Manage integrations, and selects Disconnect. Disconnecting stops new reads. It does not delete what the tool already copied, so ask the vendor to delete it, or end your account.

Xero: organisation name, then Settings, then Connected apps; select Disconnect beside the app.
QuickBooks Online: Integrations (Apps in older layouts), then Manage integrations; find the app, select Disconnect from its menu, answer the short questionnaire and confirm. Only an admin can disconnect an app, and Intuit's help notes that apps may keep your data after you disconnect them.

How does Ataski answer the checklist?

The same six questions, answered for Ataski's Financial Analyst, which connects to your accounting system to write the monthly management report. Every quotation below is copied from the page or policy linked beside it.

Permission. On QuickBooks Online: QuickBooks offers no read-only permission, so its token is technically read-write; Ataski only issues read requests. On Xero, Ataski requests Xero's read scopes, and the trust page says of that connection: Cannot create or modify any Xero data, payroll included. The rule behind both: We ask each system you connect for the narrowest grant it offers, and we name the ones that can write. Source: Financial Analyst questions, trust page, connections.
Writes. We only read — never write to your books: it posts no journal entries, closes no periods, and any ledger write is rejected. Source: Financial Analyst questions.
Training. Your data is never used to train AI. The model provider is named too: Your text is processed only by Anthropic's Claude models, and Anthropic does not train on it. The privacy policy adds that the provider's prompts and completions are not used to train its models. Source: trust page, privacy policy.
Storage. Your workspace data is stored in the United States. A few vendors process limited data elsewhere; each one's location is in the sub-processor table. The privacy policy says data is encrypted in transit (TLS 1.2+) and at rest, and Connected-account OAuth tokens are stored encrypted. How long: Customer Data is kept While customer subscription active + 30 days post-offboarding. Source: trust page, sub-processors, privacy policy, data retention policy.
Revoking. At any time, from Xero or QuickBooks Online, with the steps above and without asking Ataski: those connections are accessed only under the customer's own credential. Disconnecting stops further reads; what was already read stays in your workspace under the storage terms above. Source: privacy policy.
Leaving. Leaving works: you take everything of yours first, then everything goes. Your data is retained while the subscription is active and automatically deleted after offboarding; During that 30-day window the data remains exportable. The DPA commits to the same: Upon termination of the Services, the Processor returns or deletes all Personal Data at the Controller’s choice. Source: trust page, privacy policy, data processing agreement.

Every vendor that handles your data is listed on the sub-processor list, and the controls on the trust page are read from the running system each time the page loads.

Or have it written for you

Ataski's Financial Analyst writes the monthly management report from your accounting system. We only read — never write to your books.

Your ledger. QuickBooks Online and Xero; NetSuite, Sage Intacct, Zoho Books and Business Central in beta.
Every month on the 1st. The report is refreshed on the 1st of every month for the month just ended, as a draft that waits for your approval.
History from day one. The first connection reads the trailing 24 months, so the first report already compares each month with the same month last year.
Cash, 13 weeks out. A weekly cash forecast beside the open invoices and bills falling due.
A second reviewer. A second, independent AI reviewer reads every monthly narrative, and an AI explanation that cites a source outside your books is discarded, not published.

Plans start at $599/mo. The first month is free, and no card is needed to start it.

About the Financial Analyst Open the sample, no signup

Questions

Can an AI tool change the figures in my accounting system?

Only if it writes to your books. On Xero a tool can request read scopes alone. QuickBooks Online offers no read-only accounting scope, so a tool connected to it holds a permission that would allow writes. Ask every vendor whether it ever posts journal entries, edits transactions or closes a period, and get the answer in writing.

Is data from my books used to train AI models?

It depends on the tool and on the model provider behind it, so ask both: does the vendor use your data to train or improve models, and do its provider's terms allow training on what the tool sends? Ataski's answer: Your data is never used to train AI.

Does disconnecting an app delete my data?

No. Disconnecting stops the app from reading anything new, but what it has already copied stays with the vendor under its own retention terms; Intuit's help notes that apps may keep your data after you disconnect them. Ask the vendor to delete it, or close your account and check how long the data is kept afterwards.

What permission does a QuickBooks Online app request?

The accounting permission, com.intuit.quickbooks.accounting. Intuit offers no read-only version of it, so an app that only reads holds the same permission as an app that writes. What the app does with it is decided by the app's own code, which is why its written answer matters.

What happens to my data when I leave Ataski?

It stays exportable for 30 days after your subscription ends. Then an automated job deletes the workspace, under the Data Retention Policy published at /legal/data-retention.