Security

You're trusting us with a view into your books, or your clients' books. Here is exactly what MergeNinja can and cannot do with that access.

MergeNinja reads. It never writes.

MergeNinja connects to QuickBooks Online through Intuit and to Stripe through Stripe Connect, and it only ever reads: the customers, invoices, payments, and subscriptions needed to fill your documents. It issues no API call that creates, changes, or deletes anything in your books. One detail worth stating plainly: Stripe limits its read-only OAuth scope to a category of app MergeNinja does not fall into, so the Stripe connection is authorized with the read_write scope. MergeNinja never uses the write half of it: no charges, no refunds, no subscription or payout changes.

Tokens encrypted at rest

The OAuth tokens that link your QuickBooks or Stripe account are encrypted at rest on our servers. Your QuickBooks and Stripe passwords are never shared with us. Authorization happens on their sites, not ours.

Your card never touches our servers

Subscription billing is handled entirely by Stripe. We never see or store your card number.

Disconnect anytime

You can disconnect QuickBooks or Stripe from Settings at any moment. Disconnecting revokes our access at QuickBooks and Stripe as well, not just on our side.

Deleting your account deletes your data

When you delete your MergeNinja account, your synced data, templates, and generated documents are removed from our systems.