Security & how connections work

You’re about to be careful with your accounts. Good.

Being asked to connect your bank and books to a company you found five minutes ago should raise your guard — that instinct protects your business. So here is exactly how connecting works, what we can and cannot do, and how to shut it all off. In plain language, nothing glossed.

01

How connecting actually works

01

You sign in at your bank — not here

Connections run on the same industry rails the apps you already use are built on — read-only bank connections through Plaid (the service behind Venmo and American Express connections) and official QuickBooks connections through Intuit. When you connect, you’re taken to your bank’s or Intuit’s own login page. You sign in with them.

We never see, touch, or store your password. Ever.

What that looks like

Your bank’s own login screen — the same one you use every day — asks if you want to share view-only access with Ensemble. You say yes there, or nothing happens.

02

Your bank hands us a view-only key

What we receive is a limited, revocable token — a key that can look at transactions, invoices, and balances, and nothing else. It cannot move money. It cannot pay bills. It cannot change a single entry in your books.

Read-only means

We can look. We can’t touch. The key your bank issues doesn’t include the ability to act — that’s enforced by your bank and the connection rails, not just by our good intentions.

03

You can cut it off any time — from your side

Revoke the connection with one click in Ensemble — or go over our head entirely and revoke it from your bank’s or Intuit’s own security settings. You don’t need our permission or our cooperation to shut us out.

Your kill switch

Two ways to disconnect — ours, or your bank’s. Either one works instantly, and neither requires talking to us first.

02

What we can do — and what we can’t

With a connection, Ensemble can

Look, reconcile, and answer

  • Read transactions, invoices, and balances
  • Reconcile your books against your accounts
  • Spot patterns and answer your questions — with receipts
  • Draft actions for you to approve — a reminder, a reorder

Ensemble can never

Touch anything without you

  • Move your money or pay a bill
  • Change an entry in your books
  • See or store your bank password
  • Send anything to a customer without your approval
  • Sell your data, or use it to train AI models

The First Look report is strictly read-only, start to finish. If you later become a customer and want Ensemble to do things — send an invoice reminder, schedule a transfer — every one of those actions sits in your approval queue until you tap yes. Nothing acts on the outside world without your explicit go-ahead. That rule is in writing.

03

Where your data lives, and how it’s kept

  • Sealed per-business space. Your records live in their own walled-off space, enforced at the database layer — by architecture, not by a policy document.
  • Encrypted everywhere, on Google Cloud. In transit and at rest, on Google Cloud’s enterprise infrastructure — the same platform that runs Google itself, with Google’s global security engineering underneath it.
  • Never sold. Never trains AI. Your records answer your questions — they are not a product and not training material.
  • Everything is written down. A permanent, tamper-evident record of every action — ours and yours — that you can review.
  • Minimal by design. We pull what the report and the watch need — not your marketing lists, not your emails, unless you connect them on purpose.
  • Walk away clean. Don’t continue after your First Look? We disconnect, and you keep the report. Leave as a customer? Your records go with you, in standard formats any other system can read.
  • A human answers. Security question we haven’t covered? Ask a person, before you connect anything.

The part we can’t shortcut

Trust is earned,
not claimed.

We’re a newer company, and we won’t pretend a security page settles that. What we can do is make everything checkable: the connection rails are ones you already know, the permissions are ones your own bank enforces, and the kill switch is in your hands.

And if you’d rather look us in the eye first — book a call before you connect a single thing. Ask the hard questions. Scammers don’t schedule video calls.

Talk to a human first

Ready when you are.

Read-only, revocable, and free. Connect your books and get your First Look.

Free report — coming soon