// Trust & Security Report
Intuit Inc.
QuickBooks Online with integrated AI features; includes Accounting Agent, Payments Agent, Customer Agent, Payroll Agent, Sales Tax Agent, and Business Tax Agent (beta). QuickBooks AI is not a standalone product but rather AI capabilities embedded within QuickBooks Online.
Certifications held
4
Maturity
Enterprise
Trains on your data
Yes
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on quickbooks.intuit.com“QuickBooks maintains SOC reports that provide assurance over a service organization's internal controls, covering controls relevant to services provided including data processing, storage, transfer, and financial transactions.”
Verify on quickbooks.intuit.com“The QuickBooks Online Database is ISO/IEC 27001:2013 certified.”
Verify on quickbooks.intuit.com“QuickBooks Online is assessed annually for PCI DSS compliance and is listed on the Visa Registry of Global Service Providers.”
Verify on intuit.com“Intuit restricts transferring customer data outside the European Economic Area unless obtaining prior written consent or implementing compliant safeguards such as standard contractual clauses adopted or approved by the European Commission.”
> Show 3 unconfirmed / not-held certifications
source: quickbooks.intuit.comQuickBooks Online is not compliant with the HIPAA standards for privacy. If you are a health care professional, it is not recommended that you enter individually identifiable health information into the QuickBooks Online program.
source: intuit.comNo public evidence of ISO 42001 certification found on vendor domain.
source: intuit.comNo public evidence of CSA STAR certification found on vendor domain.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Offered
Data region
Primary data storage in USA; EU data protected by Standard Contractual Clauses with restrictions on transfers outside EEA without consent. Data accessed by global teams and partners.
QuickBooks AI learns from customer business data to provide insights and recommendations. The DPA permits Intuit to de-identify and aggregate customer information to enhance its own products and services. Most AI agents cannot be permanently disabled; only the Accounting Agent and Payroll Agent offer opt-out options, and only for specific features (e.g., opt-out of AI-powered banking page).
// Security controls
Data storage
Hosted on Amazon Web Services (AWS); protected by multiple layers of network, storage, and physical access security
quickbooks.intuit.comAudit logging
Always-On Activity Log and Audit Trail features record every login and all changes to financial transactions
quickbooks.intuit.comData protection measures
DPA commits to appropriate technical and organizational measures including encryption, pseudonymization, system resilience, and regular security assessments
intuit.comBreach notification
Upon discovering breaches, Intuit notifies customers without undue delay and assists with remediation
intuit.comSub-processor management
Intuit obtains customer consent for subprocessor use, notifies of changes, imposes equivalent data protection obligations, and remains accountable
intuit.com// Products & data scope
data: Financial transactions, invoices, receipts, bank connections, customer data, payroll (if using Payroll Agent)
Main product with integrated AI features. Available as subscription. Supports multi-user access with role-based permissions.
data: Operates on customer financial and business data within QuickBooks Online
AI agents include: Accounting Agent (receipt matching, categorization), Payments Agent, Customer Agent, Payroll Agent, Sales Tax Agent, and Business Tax Agent (beta). Limited opt-out options.
// What to watch
- AI training opt-out is not comprehensive: customer data is used to train AI models with limited opt-out options. Most AI agents cannot be disabled; only Accounting Agent and Payroll Agent offer partial opt-out.
- HIPAA NOT supported: explicitly not recommended for healthcare providers handling protected health information.
- Data training disclosure: While DPA permits de-identified and aggregated data use for product improvement, clear disclosure of customer data being used for AI model training could be more prominent.
- ISO 42001 (AI governance) and CSA STAR certifications not held: no public evidence of AI-specific governance frameworks beyond general ISO 27001.
- SOC 2 report access: some community discussions suggest difficulty obtaining current SOC 2 reports; reports cover historical periods (e.g., July 2021 to April 2022) and may lag current dates.
// At a glance
Pricing model
Subscription-based (tiered: Simple Start, Essentials, Plus, Advanced)
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Intuit Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
intuit.com