Security Policy

1. Overview

Cubica is designed to meet Intuit QuickBooks App Store security requirements. This policy describes our technical and organizational controls for the production service hosted at cubica.dev and tenant custom domains.

We review this policy at least annually and after material architecture changes.

2. Transport and server configuration

HTTPS is enforced for all application pages via TLS 1.2+ (Vercel platform default). HSTS is sent on responses.

Caching is disabled on authenticated and sensitive routes using Cache-Control: no-store, no-cache, must-revalidate.

Infrastructure runs on managed cloud providers (Vercel, Neon) that apply security patches in commercially reasonable timeframes.

The TRACE HTTP method is not used by the application; edge infrastructure rejects unused methods.

3. Authentication and sessions

Passwords are stored as bcrypt hashes; plaintext passwords are never logged or persisted.

Session cookies are HttpOnly and Secure in production, with SameSite=Lax.

Role-based access control is enforced on every server action and service call; the UI is not trusted.

OAuth authorization uses signed state parameters to prevent CSRF on QuickBooks connect flows.

4. QuickBooks OAuth token management

QuickBooks refresh and access tokens are encrypted at rest using AES-256-GCM before storage in our database.

Encryption keys are stored separately in environment configuration (TOKEN_ENCRYPTION_KEY), not in source code or the database.

Tokens and realm IDs are never exposed in URLs after authorization completes; the OAuth callback issues an HTTP 302 redirect without rendering HTML containing secrets.

Tokens are not shared with third parties and are used only to sync accounting data for the connecting organization.

On disconnect, refresh tokens are revoked with Intuit and deleted from our database.

5. QuickBooks data handling

QuickBooks data is used solely to provide in-app accounting sync (invoices, customers, payments) for the organization that connected QuickBooks.

We do not sell QuickBooks data, expose it via a public API, or export it for unrelated purposes.

Tenant isolation ensures one organization cannot access another organization's QuickBooks connection or synced metadata.

6. Logging and sensitive data

We do not log user passwords, QuickBooks tokens, payment card numbers, or full OAuth responses.

Technical logs may include request metadata (timestamp, route, organization id) for security and reliability.

7. Application security controls

We protect against common web vulnerabilities through:

• Parameterized database queries (Prisma ORM) to prevent SQL injection
• React default escaping and Content Security practices for XSS reduction
• Server-side validation on all mutations (never trusting client input)
• Signed OAuth state and session checks on integration callbacks
• Validated redirect targets (no open redirects on OAuth completion)

8. Subprocessors

Production data is processed by vetted providers under contractual safeguards, including Vercel (hosting), Neon (database), Resend (email), Stripe (payments), and Intuit (QuickBooks API).

9. Vulnerability scans and remediation

We cooperate with Intuit security reviews, affidavits, and vulnerability scan requests within the timeframes specified in the Intuit Developer Terms.

Critical, high, and medium findings from reviews are remediated before App Store publication and within two weeks for ongoing compliance notices when applicable.

10. Contact

Security reports and Intuit review inquiries: legal@cubica.dev.

Privacy/data subject requests: privacy@cubica.dev.