How source credentials are handled
You never type a QuickBooks or Xero password into DualEntry. Connecting a source runs an OAuth authorization against the source system, which returns tokens rather than credentials, and grants access scoped to the organization you authorized. The tokens that result are stored encrypted at rest. Access and refresh tokens for both QuickBooks and Xero are held in encrypted database fields using Fernet symmetric encryption, with the key supplied through application configuration rather than stored alongside the data. A database export on its own does not yield usable tokens. Access tokens are short-lived, which limits the value of one even in the unlikely event it is recovered. A Xero access token expires roughly 30 minutes after it is issued and is refreshed automatically for as long as the connection is live. Where a connection is authorized through the hosted setup flow of the replication provider rather than directly, the credential is held by that provider and DualEntry never receives it at all. Which path a given source uses is a property of the connector, not something you configure.Where source data goes during the migration
Source data reaches your ledger in two hops rather than one, and it is worth being precise about both because they have different retention. Replication. A managed replication service pulls your source system’s data into a destination schema that DualEntry owns, one schema per migration connection. That service is a subprocessor, and the current subprocessor list is published in the Trust Center, which is where a security reviewer should get it rather than from this page. Import. DualEntry reads from that schema and creates staged records, one per source record, each keyed to its source record ID. Staged records hold the source payload so a mapping can be corrected and retried without pulling from the source again. Nothing reaches your general ledger until a staged record is converted into a DualEntry transaction. That separation is why a migration can be retried, paused, and audited: the staging layer is a durable, per-record account of what the source said and what DualEntry made of it. Attachments follow a different path. Where a source system exposes them, which today means Xero, each document is downloaded and stored in DualEntry’s object storage alongside your other attachments, under the same encryption and access controls as a file you upload yourself.What DualEntry retains, and for how long
Retention differs by artifact. The table below covers each one.
The 180-day retention is enforced by a sweep rather than left to a manual step: once a stored Xero grant passes its deadline, DualEntry revokes it with Xero and clears the stored token, whether or not anyone remembered to disconnect. There is no equivalent sweep for QuickBooks, so a QuickBooks grant persists at Intuit until it is revoked there.
What disconnecting removes
Disconnecting a migration is a single action at Configuration → Company → Migrations, restricted to users with integration permission. It does three things in order:- Deletes the replication connector, which stops any further pull from the source system.
- For a Xero connection, revokes the grant with Xero, so DualEntry’s access is withdrawn at the source rather than only forgotten locally.
- Deletes the stored credentials.
What a security reviewer will ask
These are the questions that come up in practice, with the short answers. The Trust Center holds the evidence behind each.- Is the data encrypted in transit and at rest? Yes on both. Traffic runs over TLS 1.2 or higher, and customer data, backups, and sensitive fields including source tokens are encrypted at rest.
- Who at DualEntry can see our source data? Employee access to production is role-based, logged, and reviewed on a recurring cadence.
- Is the migration in SOC 2 scope? The platform is covered by an annual SOC 2 Type II examination across the Security, Availability, and Confidentiality criteria. The report is available under NDA through the Trust Center.
- Who are the subprocessors? The current list is published in the Trust Center, including the replication service a migration depends on.
- What is logged? Migration status changes are written to the audit trail, and each staged record keeps the link between the source record and the DualEntry record it produced.
- How do we terminate access? Disconnect the migration. For Xero that revokes the grant at the source. For QuickBooks it clears DualEntry’s stored tokens, and you remove DualEntry from your Intuit connected apps to revoke the grant itself. See the section above.
Send a security reviewer to trust.dualentry.com rather than answering a questionnaire by hand. Gated documents are released after a clickthrough NDA, which is usually faster than the email thread it replaces.