How the QuickBooks connection is made
Connecting a company starts on Intuit's own sign-in screen. The person connecting logs in to QuickBooks Online there, picks the company and approves access. ReceiptQBO receives an access token from Intuit, not a username or password. We never see, store or ask for QuickBooks credentials.
The access requested is the com.intuit.quickbooks.accounting scope. That is the scope for accounting data: the lists and transactions a receipt tool needs to read and write. It does not include payroll or payments scopes, and ReceiptQBO does not request them.
Tokens expire and are refreshed in the background while the connection is active. If a refresh fails, for example because someone removed the app inside QuickBooks, the company shows as disconnected and nothing posts until a person with access reconnects it. Documents keep arriving and waiting in the meantime, so no receipt is lost during the gap.
Every connection is per company. A bookkeeper with 25 clients has 25 separate connections, and one client's token can never be used to read another client's books.
What ReceiptQBO can and cannot do in your books
It helps to be precise about what the connection is used for. ReceiptQBO reads the lists it needs to code a receipt: accounts, classes, locations, customers, projects and vendors. It reads bank and card transactions so a receipt can be matched to a charge that already exists.
It writes only these things:
- a new Expense (Purchase) or Bill, with the receipt image attached,
- an attachment added to an existing transaction when a receipt matches it,
- a new vendor when the receipt is from a vendor the company does not have yet.
It does not delete transactions, edit posted entries you created yourself, change the chart of accounts, reconcile accounts, run payroll, move money or pay bills. A Bill created from a scanned document is a record of what is owed. Paying it is still done by a person in QuickBooks or your payment tool.
If you want an extra layer of control, set a high confidence threshold or route everything through the approver role, so nothing posts without a named person signing off. The how it works page explains thresholds in detail.
Fwd: Your Lowe's receipt
Forwarded email, 2 min ago
IMG_4471.HEIC
Client link, 9 min ago
Invoice #88213 from Sunbelt Rentals
Gmail filter, 22 min ago
38 files from October folder
Batch upload, 1 hr ago
Encryption and where receipts live
Receipts are financial records and often carry card digits, addresses and names. They are treated that way from the moment they arrive.
- In transit. The app, the upload link and the API all run over TLS. Files uploaded from a browser or phone are encrypted on the way in.
- At rest. Receipt files and the QuickBooks tokens are encrypted at rest.
- Card numbers. ReceiptQBO reads only the last 4 digits of a card from a receipt, which is what you need to tell company cards apart. It does not store full card numbers.
Subscription payments for ReceiptQBO itself are handled by a payment processor. Card details for your plan go directly to that processor and never touch our servers.
Receipt emails sent to a forwarding address are processed through our email provider and then stored with the rest of the client's documents under the same encryption.
Who can see client files
Access inside a practice is set by role. There are five: owner, admin, preparer, reviewer and approver. Preparers handle intake and coding, reviewers clear the Review queue, approvers give final sign-off before posting, and admins manage clients and settings. On the Firm plan, roles can be set per client, so a contractor bookkeeper who only works on three companies sees only those three.
Clients who send receipts through the no-login upload link can add documents but cannot browse them. The link is an upload door, not a window into the books. Someone who forwards to a client address sees nothing either: the address only receives.
Removing a person from the practice removes their access to every client at once, and the audit trail keeps the record of what they did while they had it.
Sign in with Google is available on the Firm plan, so the practice can manage who has access through its own Google Workspace accounts and remove a departing employee in one place.
Expense, ready to post
96%- Vendor
- Sunbelt Rentals
- Account
- 6600 Equipment Rental
- Class
- Field Ops
- Location
- Round Rock
- Project
- Lakeview Deck Project
- Billable
- Yes, to customer
The audit trail
Every document has a history you can read line by line: received, read, rule applied, edited, approved, posted, each with a time and the person or rule responsible. If a total was changed from 84.20 to 48.20 in review, the log shows who changed it and when.
That trail answers the questions that come up at year end or in a client dispute. Why was this coded to Meals instead of Travel? A vendor rule did it. Who approved the 2,400 dollar equipment bill? The log says. Was the receipt there before the expense was posted? The timestamps show it.
On the Firm plan the audit log can be exported for a period, and the monthly reconciliation report lists what came in, what posted, what matched the bank and what is still missing. Practices that hand books to a CPA or face a review can give a clean record instead of rebuilding one from emails. The receipt workflow for accounting firms page shows how the roles and the log fit together.
Retention, deletion and disconnecting
Documents are kept for as long as your account is active, so you can go back to a receipt from last year when a client asks. You can delete a document at any time. Deleting it removes the file from ReceiptQBO. It does not remove an image already attached in QuickBooks Online, because that copy belongs to the company's books. Note that deleting a document does not give back usage in your monthly limit.
Files uploaded to the home page demo, without an account, are deleted within 24 hours.
When you disconnect a company, ReceiptQBO revokes its QuickBooks tokens right away. Nothing can be read from or written to that company after that point. Everything already posted stays in QuickBooks, because it is part of the client's books. When you close your account, you can export your documents first to Excel, CSV or a QuickBooks bill import CSV.
Plans and limits for one company, a bookkeeping practice or a larger firm are on pricing, and the full product is described on the QuickBooks receipt scanner page.