QuickBooks security review: what Intuit requires each year

Once a QuickBooks Online integration passes 500 connected QuickBooks companies, or is listed on the QuickBooks App Store, Intuit's security bar for it includes an annual QuickBooks security review run by an external vendor. QuickBooks Online is one of the most widely used accounting platforms for small and mid-sized businesses, so many SaaS teams reach that number sooner than they plan for.

Some of the larger companies we work with have raised this review with us as a recurring pain point. The requirements are published, and many of them are standard web security controls such as HTTPS and cookie flags. Knowing what Intuit checks, and preparing for it ahead of time, keeps the review predictable. In short:

• In scope: any QuickBooks Online app listed on the QuickBooks App Store or connected to more than 500 QuickBooks companies.
• The test: a yearly security scan of your running app by Intuit's external vendor, against Intuit's published requirements.
• The deadline: Intuit asks for findings rated medium or above to be fixed within two weeks of notification.

Scope and timing of the review

Intuit runs two separate checks. The app assessment questionnaire applies to every app that requests access to production QuickBooks data, whether or not the app is listed on the QuickBooks App Store, per Intuit's app assessment FAQ. It is a self-attestation in the developer portal, completed as part of getting production access. Intuit estimates it takes about 40 minutes once you have the information ready. If an app is rejected, it cannot add new QuickBooks connections until Intuit has reviewed its answers.

The security review is the other check. Intuit's security requirements page states that all App Store apps, and any app with over 500 connections, are reviewed annually or more often at Intuit's discretion. A private, unlisted integration enters this cycle once it passes 500 connected companies.

Intuit's older app assessment FAQ (January 2023) describes the in-depth annual reviews as applying only to App Store apps. The current security requirements page includes apps with over 500 connections, so plan for the review once you pass that number.

For listed apps, Intuit documents the annual cycle on its compliance maintenance page, and counts it from the date it first approved the app:

• Around month 11 after your app passed its security review, Intuit emails you to say its security review vendor will be in touch.
• Around month 12, the vendor emails you and asks for the information it needs to test your app.
• No response within 30 days: the vendor sends a reminder.
• No response to the vendor's second reminder within 14 days: Intuit sends a notice.
• No response within another 14 days: Intuit removes the app from the QuickBooks App Store.

Intuit's page describes this timeline for App Store listings. It does not spell out the sequence or the penalty for unlisted apps that qualify through the 500-connection threshold.

Intuit's security requirements

Intuit publishes the full list on its security requirements page. The items fall into seven groups.

Area	What Intuit requires
Server and transport	HTTPS on every page; TLS 1.1 or higher (1.2 recommended); OS, web server and app server patches current; TRACE and unused HTTP methods disabled; no-cache and no-store on all SSL and sensitive pages; no logging of credentials or QuickBooks data
Common vulnerabilities	Protection against CSRF, reflected and stored XSS, SQL injection and XML injection; sound authentication, session management and function-level access control; validated redirects and forwards
QuickBooks data usage	No third-party access to a customer's QuickBooks data; no exporting or storing it beyond what the app needs to function
Cookies	Secure and HttpOnly set on every session cookie
OAuth tokens	Tokens and customer identifiers never exposed or shared; refresh token and realmID encrypted at rest with AES (preferred) or 3DES; encryption key kept in a separate configuration file
Token-bearing endpoints	Endpoints that receive tokens or sensitive data in URL parameters return a 302 redirect, not an HTML body, so values cannot leak through the Referer header
User credentials	Storing end users' credentials for another source (such as a bank login) needs Intuit's prior written approval; stored passwords must be one-way hashed with SHA-256 or better

On top of the test, Intuit's security requirements page, citing its developer terms, sets standing obligations: let Intuit run vulnerability scans within two weeks of a request, or share reputable scan results from the past year instead; complete a security affidavit within two weeks of a request; and promptly fix anything the scans or app reviews find. Intuit can reject scan results you share, then run its own scans or require a new one.

Intuit's security review vendor has also shared where apps most often fall short. In a 2021 post on Intuit's developer blog, Synopsys, the review vendor at the time, named cross-site scripting as the issue it found most often. Its other top high-severity findings were cross-site request forgery, pages without HTTPS and verbose error messages that expose stack traces.

How to prepare

Most of the work is timing and coordination. Intuit gives notice well ahead, with an email about a month before the vendor reaches out and then several reminders. Intuit asks for findings from an ongoing review to be fixed within two weeks, so the goal is to have few of them.

• Track your number of connected QuickBooks companies and flag the 500 mark before you cross it.
• Put the 11-month date of your app's annual review cycle on a shared calendar, with a named owner and a backup.
• Make sure the inbox tied to your Intuit developer account is read by more than one person.
• Keep an environment the vendor can reach, with test accounts that have full permissions, ready year-round.
• Run the self-checks below after major releases, and add most of them to CI with the GitHub Action version of Apideck's review check.
• Run a DAST scanner such as OWASP ZAP against that environment before the vendor does.
• Reserve engineering time for the two weeks after you expect the report.
• Keep last year's report and fixes where the next owner can find them.

Quick self-checks

Replace app.example.com with your app's domain. These cover the configuration items on Intuit's list. Code-level issues such as XSS and injection need a scanner or a code review.

Requirement	Command	A pass looks like
HTTPS on every page	curl -sI http://app.example.com	A redirect (301, 302, 307 or 308) to an https:// URL
TLS 1.1 or higher	openssl s_client -connect app.example.com:443 -servername app.example.com -tls1 -cipher 'DEFAULT@SECLEVEL=0' (on macOS's built-in LibreSSL, drop the -cipher option)	The handshake fails, usually with "alert protocol version", meaning your server refused TLS 1.0; a handshake-failure alert or closed connection also counts. A fail shows Protocol: TLSv1 with a negotiated cipher. "No protocols available" means your local OpenSSL blocked the test, so it did not run
TRACE disabled	curl -si -X TRACE https://app.example.com	A 4xx or 5xx refusal, never 200
No caching of sensitive pages	curl -sI https://app.example.com/<sensitive-page> with a valid session cookie	Cache-Control includes no-cache and no-store
Secure and HttpOnly session cookies	curl -sI on the response that sets your session cookie	Every session Set-Cookie line includes Secure and HttpOnly
302 on token-bearing endpoints	curl -si "https://app.example.com/<callback>?code=test"	302 Found with a Location header and no HTML page
No verbose errors	Request a page that does not exist, then send a malformed request	A generic error page with no stack trace

To run these checks in one go, Apideck's free QuickBooks review check probes a deployed app for the items above except verbose errors, which you still check by hand, and scans your source code for token storage, key handling, logging and CSRF issues. The source scan runs in your browser, so no file is uploaded. The checker is MIT licensed and also runs from a terminal with npx @apideck/quickbooks-review-check or as a GitHub Action, so it can run on every pull request; those two can send a session cookie to check caching on signed-in pages. It looks for known patterns, which means code-level flaws such as XSS and access-control gaps still need a penetration test or DAST scan.

How the QuickBooks security review differs from SOC 2

The review is a security scan of your running app, carried out by Intuit's external vendor. Findings are rated by severity, and anything rated medium or above needs to be fixed. That makes it a different exercise from SOC 2.

	SOC 2	Intuit annual security review
Performed by	An independent CPA firm you hire	Intuit's security review vendor
What is assessed	Your organization's controls against the AICPA Trust Services Criteria	Your app against Intuit's security requirements
Method	Auditor assesses control design at a point in time (Type 1), or design and operating effectiveness over a period (Type 2)	Security scan of your running app
Output	Attestation report, usually shared with customers under NDA	Findings rated by severity; medium and above must be fixed

We found no Intuit documentation stating that a SOC 2 report replaces the review.

Running QuickBooks through Apideck

With Apideck you register your own app with Intuit and remain the application owner, so the questionnaire and the annual review still apply to you. What a unified API takes off your plate is the token handling.

Requirement area	Without Apideck	With Apideck
OAuth flow, token encryption, storage and refresh	Your code and your key management	Stored encrypted and refreshed automatically by Vault
Questionnaire answers on token handling and error cases	Researched by your team	Suggested answers in our QuickBooks compliance docs
QuickBooks data at rest	Wherever your sync layer stores it	Apideck keeps no copy of QuickBooks Online records, which pass through in memory. OAuth tokens are kept encrypted in Vault. Optional API logs can hold request and response bodies, and you can set their retention to 0
Server config, cookies, XSS, CSRF, access control in your app	Yours	Still yours
Responding to the vendor and fixing findings within two weeks	Yours	Still yours

In practice that moves the OAuth token section of Intuit's list out of your codebase.

Your own app's security and the response to findings stay with you. You get a smaller surface to defend every year, and one QuickBooks connector that shares its auth and data layer with the other accounting platforms your customers use. To talk through your QuickBooks integration and the review ahead of it, book a demo.