> For the complete documentation index, see [llms.txt](https://docs.mosofin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mosofin.com/security-and-privacy/gdpr-and-security-compliance.md).

# Security and privacy

Use MosoFin to review financial data without giving an agent permission to change the books.

MosoFin reads approved QuickBooks data on demand and does not maintain a standing copy of source financial records. It does store the account, connection, output, and audit information needed to operate the service.

## Data MosoFin handles

| Data                               | How it is used                                                                                                                        |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| **Account and workspace details**  | Identify users, workspace memberships, roles, and permissions.                                                                        |
| **Connection settings and tokens** | Make authorized, read-only requests to the selected QuickBooks company.                                                               |
| **Source financial records**       | Answer the requested question at the time of work. MosoFin does not run a background sync or keep a separate warehouse of the books.  |
| **Generated outputs**              | Provide the reports, drafts, and skill results requested through the service.                                                         |
| **Audit and usage metadata**       | Record tools called, skills run, timestamps, and request or response metadata needed for traceability, limits, support, and security. |

## Controls applied to each request

| Control              | Effect                                                        |
| -------------------- | ------------------------------------------------------------- |
| **Workspace scope**  | Limits the request to the active client or company workspace. |
| **Role**             | Limits the actions available to the signed-in user.           |
| **Tool policy**      | Allows the read, requires approval, or blocks it.             |
| **Read-only access** | Prevents MosoFin from posting or changing QuickBooks records. |
| **Usage limits**     | Applies the capacity available to the account.                |

## Third-party processing

* **Anthropic:** Processes prompts and resulting content when you use MosoFin through Claude.
* **Intuit:** Authorizes QuickBooks access and returns the records required for a permitted request.
* **Service providers:** Support hosting and service operations under contractual limits.

Review each provider's terms and privacy practices before sending information through its service.

## Retention and deletion

MosoFin keeps account and connection information while the account is active. It keeps connection tokens until the source is disconnected or the account is closed. Audit logs are retained for the period needed to provide the service and meet legal and security obligations.

When information is no longer needed, MosoFin deletes or de-identifies it. Contact support to request access, correction, deletion, or a copy of personal information. MosoFin may need to verify the requester's identity.

## Your responsibilities

* Confirm the workspace and QuickBooks company before authorizing access.
* Give each user the minimum role required for their work.
* Require approval for sensitive reads.
* Review generated answers before sharing or acting on them.
* Keep credentials, tokens, payment details, and client financial data private.
* Remove access when a person no longer needs the workspace.

For the current legal terms, retention details, and privacy rights, review [MosoFin Security](https://www.mosofin.com/security), the [Privacy Policy](https://www.mosofin.com/privacy), and the [Terms of Service](https://www.mosofin.com/terms).

> **Note:** MosoFin does not claim that one configuration automatically satisfies every regulatory or professional obligation. Your organization remains responsible for its own compliance review.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.mosofin.com/security-and-privacy/gdpr-and-security-compliance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.