Heesab Security Summary

Effective: June 17, 2026

This Security Summary describes Heesab's current pilot security posture. It is written for pilot customers and Intuit production-readiness review. It should be read with the Privacy Policy, Terms of Service, and Data Retention Policy.

Heesab is operated by Basha Holdings LLC d/b/a Heesab.

Security contact: [email protected]

Support contact: [email protected]

Product Scope

Heesab receives invoice emails, parses invoice documents, maps vendors and accounts, and posts approved or trusted routine invoices to QuickBooks Online as Bills. Heesab does not run payroll, make payments, move money, file taxes, or provide accounting advice.

Access Control

Current controls include:

• Dashboard login with email and password.
• Password hashes instead of plaintext passwords.
• HttpOnly session cookies.
• Tenant-scoped backend access patterns.
• Tenant-scoped client accounts for self-serve activation.
• Email verification required before client QuickBooks connect.
• Operator email-code MFA after password login.
• Process-local rate limits for login, client signup, and operator bootstrap.
• App-side Cloudflare Turnstile support for client signup when keys are configured.
• Operator-only administration for cross-tenant and higher-risk actions during the pilot.
• Bootstrap setup key limited to first-account setup or emergency operator reset.

Before broader client self-serve access, Heesab still plans to complete the sandbox/production split

decision, run the final security check, and add client authenticator-app MFA as a future option.

QuickBooks Security

Current controls include:

• Intuit OAuth consent for QuickBooks Online authorization.
• QuickBooks access and refresh tokens encrypted at rest.
• One-time, server-side OAuth state.
• Tenant QBO environment separation for sandbox and production.
• QuickBooks token deletion when a customer disconnects or closes an account, unless retention is required for legal, security, or dispute reasons.

For the v1 invoice-to-Bill workflow, Heesab is intended to request the QuickBooks Online Accounting scope.

Auto-Post Guardrails

Heesab is designed so routine trusted invoices can auto-post only when guardrails are met. Current guardrails include:

• Active tenant required.
• Active email-to-Bill workflow required.
• Complete trusted vendor mapping required.
• QuickBooks vendor and account ids required.
• Confidence threshold required.
• Invoice number and positive total required.
• Optional amount cap.
• Always-review override.
• Tenant pause/resume control.
• Duplicate invoice detection.
• Idempotent QuickBooks Bill posting requests.
• Source invoice files uploaded to QuickBooks Bill attachments for newly queued invoices.
• QBO Bill delete reconciliation for test/corrected Bills; unsupported Bill void is disabled after

production testing showed QBO did not actually void the Bill.

Unknown, unmapped, incomplete, low-confidence, duplicate, unusual, paused, or over-limit items stay in review instead of auto-posting.

Audit Trail

Heesab records important operational events, including invoice receipt, queueing, mapping, edits, approvals, rejections, auto-post decisions, QuickBooks posts, errors, tenant status changes, and connection events.

Audit logs are database-enforced immutable against update, delete, and truncate. This supports accountability for actions taken in customer books.

Data Security

Current controls include:

• Encrypted QuickBooks tokens at rest.
• Password hashing.
• Session cookies marked HttpOnly.
• Tenant-scoped queries and route guards.
• Provider secrets stored in environment variables.
• Duplicate prevention through fingerprints and content hashes.
• Limited public health checks that avoid exposing secrets.
• Operational preference to pause, disable, or disconnect rather than hard-delete audited records.

No system can guarantee absolute security. Customers should report suspected unauthorized access, incorrect posting, misdirected invoice forwarding, or token exposure to [email protected].

Incident Response

If Heesab suspects unauthorized access, incorrect posting, token exposure, or misdirected invoice data, the expected pilot response is:

• Pause the affected tenant.
• Stop auto-post workflows for the tenant.
• Disable affected sessions if account access is involved.
• Preserve relevant audit and provider logs.
• Notify the customer contact with known facts and immediate mitigations.
• Revoke and reconnect QuickBooks authorization if token exposure is possible.
• Document corrective actions before resuming automation.

The internal operator runbook for these steps is `docs/INCIDENT_RESPONSE_RUNBOOK.md`.

Providers

Heesab currently uses third-party providers to operate the service, including:

• Intuit and QuickBooks Online for accounting connection and Bill posting.
• Anthropic for AI-assisted invoice parsing and mapping suggestions.
• Supabase for database services.
• Railway for backend hosting.
• Cloudflare for email routing, DNS, and edge services.

Provider use may change as the product matures.