Your congregation's giving is among the most sensitive data a church holds. Our answer is architectural, not just contractual: GivingBooks Sync is designed so the most sensitive data never enters our systems in the first place.
Donor names and emails are never stored and never posted. The engine matches deposits using Planning Center donation IDs, amounts, and fund designations — that is all it keeps and all it writes to QuickBooks. Entries and audit records reference IDs like "donation 48291103," never who gave, never an email, never payment details. This isn't a privacy setting that could be misconfigured; the product has no tables to store donor identities in.
You connect Planning Center and QuickBooks through their official OAuth flows. We never see, ask for, or store your password for either system. Access is scoped: read-only giving data from Planning Center, accounting writes to QuickBooks — nothing more.
All traffic uses TLS. OAuth tokens and credentials are encrypted at rest with versioned, rotatable keys, separate from the application database credentials.
Every entry we post is recorded in an append-only event log: what posted, when, from which source period, and what happened afterward (retries, adjustments, mapping changes). Your auditor can trace every number in QuickBooks back to its source.
Disconnect from inside the app, from Planning Center, or from QuickBooks — any of the three works instantly. When you offboard, we revoke both tokens and purge your credentials and cached data. Entries already posted remain in your QuickBooks, because they're your books.
Every uploaded payout file carries Planning Center's organization identifier, and we verify it against the connected church before parsing a single row. A bookkeeper managing many churches can never post one church's payout into another church's books — the file is rejected, not "handled."
By default, every entry waits in an approval queue until a human accepts it. Auto-posting is something you opt into per church, when you've seen enough to trust it — and even then, anything the matcher can't prove to the penny is flagged and held, never posted on a guess.
If you upload a payout CSV, we parse it, keep only the donation IDs, amounts, and fund designations the matcher needs, and discard the raw file. Row-level donor names and emails are never retained.
The database (fund totals, donation IDs and amounts, mappings, audit log — no donor identities) is backed up on a schedule to independent storage, and restores are actually tested, not just assumed.
If your finance committee, auditor, or denomination has a security questionnaire, send it over — we'd rather answer hard questions before you connect than after. hello@givingbookssync.com
See also: Privacy policy · Terms of service