Security, in plain terms · reviewed September 9, 2026
Your access is always yours.
Before connecting QuickBooks, every owner asks the same two things: what can you see, and what could go wrong. Here is the full answer, with what you can check yourself.
What Luca can see
During the free diagnostic
Read only. Luca reads your reports and transactions to grade the books and write the cleanup plan. It cannot post, edit or delete anything.
As a client
Luca posts entries in your own QuickBooks file, because that is the service. Every entry is visible there and recorded in the change log. Nothing moves to another system.
Never
Your QuickBooks password, your bank password, another company's rows, or your data sold, shared with third parties, or used to train models.
Ten safeguards
- 01
Your access is always yours.
Luca connects through Intuit's own authorization screen, never with your password. The subscription stays in your name, and you can cut the access from your QuickBooks settings any day, without asking anyone.
How you can check: In QuickBooks: the gear icon, then Apps. Luca is listed there with its own Disconnect button, and it takes effect immediately.
- 02
Disconnecting is one button, at both ends.
When you or your accountant disconnect from inside Luca, Luca also tells Intuit to revoke the connection, so a copy of the keys taken earlier is worthless from that moment.
How you can check: After a disconnect, Luca no longer appears under Apps in QuickBooks.
- 03
The connection keys are stored encrypted.
The keys that let Luca talk to QuickBooks and to a bank feed are encrypted at rest with a key that lives outside the database, and that key is rotated on a written procedure. A stolen database would hold ciphertext, not your books.
- 04
Every company is walled off inside the database.
Each row of data carries your company id, and the database itself refuses to hand a row to anyone who is not a member of that company. Screens, exports and the portal all run through that same wall, and the wall is retested automatically on every change Luca ships.
- 05
Every change in your books is recorded.
What changed, from what, to what, when and by whom, for every entry Luca posts to QuickBooks. It is your own QuickBooks file, so you also see each entry there, the same as if a bookkeeper had typed it.
How you can check: Ask for the change log for any period. It is yours.
- 06
Signing in takes a code from a phone.
Always for your accountant, and for you if you switch it on. The database checks that second step on its own, not only the app, so a stolen password alone opens nothing.
How you can check: Any authenticator app works. Your accountant sends you the link and it takes about a minute.
- 07
Files live in private storage.
Documents, receipts and attachments are stored in private buckets and served through short-lived links, never public addresses. Each bucket caps what types and sizes it accepts.
- 08
Bank connections go through Plaid.
If you connect a bank feed, you do it on Plaid's own screen. Luca never sees a bank password, and the feed can only read.
- 09
Automated messages have to prove who sent them.
Bank updates arrive signed by Plaid and are checked before they are read. An email forwarded into your thread posts as you only when the sending domain proves it is yours; anything else waits for a person, and every automatic post is announced to your accountant the moment it lands.
- 10
Reviewed against a written standard.
Luca has a written security standard that every change is checked against. Dependencies are watched for known flaws automatically, secrets are scanned on every commit, and the last full audit finished in September 2026 with every finding fixed.
How you can check: Ask for the standard. It is a document, not a badge.
None of this makes the risk zero.
It makes it small, visible, and reversible from your side. You can leave any month with no notice period, and your QuickBooks file, your closed months and every report ever written for you stay yours. That is the standard I would want for my own books.