Security
How S2Q connects to your accounts, what it can and cannot do, and how your credentials are protected.
Last updated: July 2026
The short version
S2Q touches your books, never your money. It reads your Stripe activity, posts the matching entries into QuickBooks Online, and stops there. It cannot move funds, initiate a payout, or change your Stripe balance.
How each connection works
QuickBooks Online: Intuit OAuth
You authorize S2Q through Intuit's official OAuth flow: you are redirected to Intuit, you approve access to your company, and you are sent back. S2Q receives a revocable access token, never your Intuit password. You can revoke it at any time from your Intuit account or by disconnecting inside S2Q.
Stripe: a restricted API key
Stripe does not offer OAuth for this kind of integration, so you connect with an API key you generate in your own Stripe dashboard. We recommend a restricted, read-only key with read access to the payout, transaction, and customer data S2Q needs (the exact scopes are shown during setup). A read-only key means S2Q cannot create charges, refunds, payouts, or transfers, even in principle. Full secret keys are accepted too, but a restricted key is the safer choice and the one we recommend.
Your Stripe key is encrypted before it leaves your device
When you paste your Stripe key, it is encrypted in your browser with AES-256-GCM, using a key unique to your account, before it is ever sent to our servers. We store only the encrypted value. It is decrypted in memory only when a sync actually runs, to call Stripe on your behalf.
What S2Q reads and writes
- From Stripe (read only): payouts, balance transactions (charges, fees, refunds), and the customers attached to them.
- To QuickBooks (write): gross sales as income, Stripe fees as expenses, and each payout as a deposit through a clearing account, so every deposit ties to your bank statement. It writes accounting records only.
S2Q never reads or writes anything outside these accounting records.
Preview before anything posts
Every sync has a free dry run: it walks the exact same analysis without posting to QuickBooks or spending a credit, so you see precisely what would post. Real syncs are oldest-first and idempotent. If a run is interrupted, re-running it never double-posts, because already-synced transactions are skipped.
Disconnecting
You are always in control. Disconnect QuickBooks or Stripe from inside S2Q at any time, revoke the authorization from your Intuit account, or roll your key in your Stripe dashboard. Once disconnected, S2Q can no longer reach that account.
Scope, honestly
S2Q syncs Stripe to QuickBooks Online, in USD only. We would rather do one integration and one currency correctly than many badly. If your needs are broader, S2Q may not be the right fit, and we would rather say so up front.
Questions
Signed in? Reach us from the Support panel inside the app and we will answer any security question directly.