Privacy Policy

Bourque AI Business Agent — last updated September 9, 2026

The Bourque AI Business Agent (the "Application") is a private tool built for Bourque & McLucas CPAs to prepare tax-grouped workpapers, book-review exceptions, and adjusting entries from a client's accounting data. It is not a public product and is not offered to the general public. This policy explains what data the Application accesses and how it is handled.

1. Data We Access

• QuickBooks Online data — with a client's explicit OAuth authorization (Intuit "Connect to QuickBooks"), the Application makes read-only calls to the QuickBooks Online API to pull the Trial Balance, Chart of Accounts, and General Ledger reports for a selected reporting period. The Application never writes, edits, or deletes anything in a connected QuickBooks company.
• Uploaded files — as an alternative to a live QuickBooks connection, a firm user may upload trial balance / general ledger export files (.xlsx/.xls) directly.

2. How Data Is Used

Account balances and transaction rows are used only to: classify accounts to the firm's tax-grouping taxonomy, run book-review checks, compute a tax payment breakdown, draft proposed adjusting journal entries, and generate the resulting workpaper and client deliverable files. Some of this classification is performed by an AI model call to a large-language-model gateway (an OpenAI-API-compatible service proxied through a private LiteLLM gateway on Microsoft Azure); only the account name, type, and numeric context needed for classification is sent — never QuickBooks login credentials. No dollar amount in a finding or proposed entry is authored by the AI — every amount is taken directly from the underlying trial balance or general ledger data.

3. Where Data Is Stored

The Application runs on a single server hosted on Microsoft Azure. Parsed trial balances, classifications, run history, generated workpapers, and QuickBooks OAuth tokens are stored in a SQLite database and on local disk volumes attached to that server, accessible only to authorized firm staff through the Application's own password-protected login. Data is not sold, shared with advertisers, or used for any purpose other than producing the engagement's workpapers.

4. QuickBooks OAuth Tokens

OAuth access/refresh tokens issued by Intuit are stored per company, encrypted at rest on the host filesystem with restricted file permissions, and used solely to refresh API access for that company's connection. Disconnecting a company (from within QuickBooks' Connected Apps settings, or via the Application) deletes the stored token and immediately ends the Application's access to that company's data.

5. Security

All traffic to the Application is served over HTTPS (TLS). Logins are password-protected (passwords stored as salted PBKDF2 hashes, never in plain text) with session cookies scoped to authorized firm staff.

6. Data Retention

Data is retained for the life of the engagement so run history and prior review decisions remain available across reruns. A firm administrator may request deletion of an engagement and its associated data at any time.

7. Contact

Questions about this policy: Ryan Bourque, CPA — Bourque & McLucas CPAs.