FigureIQ Data Security Summary

Sensitive accounting data is kept behind restricted access paths

FigureIQ uses separate infrastructure layers so that public requests do not connect directly to the application or database servers.

The application servers operate within a private subnet in a private Virtual Private Cloud (VPC). They are not exposed directly to the public internet or to other networks. An application load balancer receives and routes application traffic while keeping the private IP addresses of the application servers from being exposed publicly.

FigureIQ uses dedicated database servers. These servers are also deployed in the private subnet and are not directly exposed to the public internet or another network. Security groups restrict database connectivity to an allowlist, and only the application servers are permitted to connect to the database servers.

This design limits database access to the systems that need it. A user works through the application rather than connecting directly to the infrastructure that stores FigureIQ’s operational and accounting data.

Documents and backups in object storage are access-controlled

FigureIQ uses an object storage service for two important categories of data:

• Images and PDFs uploaded by users, including invoices, receipts, and bank statements.
• Database dumps used for recovery of data.

The object storage service does not sit inside FigureIQ’s private VPC. Access is therefore controlled through bucket policies. These policies are configured so that the application servers - and no other machines - can access the relevant buckets.

Uploaded documents and database backups are not publicly accessible.

Client and business records stay within distinct workspaces

FigureIQ organizes files in object storage first by organization and then by the client or business to which they belong. For an accounting practice, this means separate storage paths for each client. For an in-house accounting team that manages multiple entities or subsidiaries, it means separate paths for each business.

This structure applies to documents stored in DocuVault, documents uploaded for extraction but not saved to DocuVault, and any additional attachments. It helps ensure that each document remains associated with the correct organization, client, or business throughout processing.

Each client or business also has its own QuickBooks Online connection and accounting context. That context includes settings and reference data such as currency and country, item codes and names, tax codes and rates, payment terms, user preferences, and payment, expense, and income accounts. This helps ensure that FigureIQ processes and publishes transactions to the correct client or business account.

User roles control access and publishing permissions

FigureIQ’s identity and access management model uses six roles with progressively broader permissions. This gives firms and accounting departments a practical way to distinguish people who need visibility, people who prepare transactions, people who can approve and publish them, and people who administer the account.

These roles determine who can prepare, approve, and publish transactions to QuickBooks. A Standard User can prepare a transaction and submit it for approval, but cannot publish it. Only Advanced Users and authorized administrators can publish transactions to QuickBooks. Teams can therefore place preparation and publication with different levels of responsibility while keeping the workflow straightforward for day-to-day users.

FigureIQ controls how data moves between connected services

FigureIQ uses information from QuickBooks Online to provide the accounting context needed for processing. It retrieves currency settings, item codes and names, tax codes and rates, default payment terms for sales transactions, user preferences, payment, expense, and income accounts, and the relevant country setting.

In the other direction, FigureIQ can publish sales and cost transactions to the connected QBO account. Users can also add supporting attachments to QBO through the FigureIQ interface. Each client or business has its own QuickBooks connection, helping ensure that data is sent to the correct account.

The Google Drive integration has a narrower role in the workflow: users can import files from Drive into FigureIQ. FigureIQ does not send your files or accounting data back to Google Drive.

Activity records support accountability

Important actions in FigureIQ are recorded in the database and attributed to individual users. These actions include document uploads, corrections to extracted data, reviews, permission changes, and publication to QuickBooks Online.

For reviewers and administrators, this creates a traceable record of who performed a consequential action. It can help a practice or accounting department review a transaction’s history, understand corrections or permission changes, and investigate unexpected activity.

Encryption protects data at rest and in transit

FigureIQ encrypts database data at rest. At-rest encryption provides an additional safeguard for stored database information if the underlying storage is accessed outside its intended path.

Traffic between the application servers and database servers is also encrypted in transit. This protection is applied even though both server layers operate inside the same private subnet and private VPC. Encryption protects data as it moves between FigureIQ’s application and database servers, adding another layer of security beyond network controls.

Platform defenses reduce exposure and preserve investigative evidence

FigureIQ places its application and database servers in private infrastructure and uses controlled entry points rather than exposing those servers directly. At the application edge, a web application firewall helps filter malicious traffic and mitigate attacks, including distributed denial-of-service attempts.

FigureIQ also logs event traces across user-level activity and service-to-service activity. These records help FigureIQ identify suspicious activity and investigate potential security incidents.

FigureIQ combines network isolation, allowlisted database connectivity, bucket policies, edge filtering, encryption, and event logging. Together, these safeguards provide multiple layers of protection for sensitive accounting information.

Backups support recovery after a disruption

FigureIQ maintains a disaster-recovery approach for its databases using two complementary backup mechanisms.

FigureIQ’s cloud infrastructure automatically creates a database snapshot each day. These snapshots are retained for seven days, allowing FigureIQ to restore recent data if the live database is disrupted.

For data beyond that seven-day window, FigureIQ creates automated database dumps and stores them in object storage. This second backup method extends recovery coverage beyond the recent snapshot set. Access to the storage buckets is restricted through bucket policies.

Using two backup methods gives FigureIQ both recent recovery points and longer-term recovery coverage.

Conclusion

FigureIQ combines scoped access, controlled accounting workflows, protected infrastructure, traceable activity, and recoverable data to support the day-to-day security needs of professional accounting teams. These safeguards are designed to let organizations automate document processing while retaining clear control over sensitive information and what reaches their books.