Privacy notice

Effective date: October 24, 2026

Who we are

Cosigne is a hosted service operated by IT-TECH (“we”, “us”). It lets Canadian bookkeeping firms connect their clients’ QuickBooks Online Canada files to each bookkeeper’s own AI assistant: Claude (Anthropic) or ChatGPT (OpenAI). This notice explains what personal information we handle through this website and through the service, and your rights under Québec’s Act respecting the protection of personal information in the private sector (Law 25).

Two roles

Your firm is the party responsible for the personal information in its clients’ books. For that information, we act as your firm’s service provider: we handle it only to provide the service to your firm. Our data processing agreement sets out how. In this notice, a business owner who signs up for their own company is treated as the firm.

For the information about your firm’s own account — the people who use it, their emails and billing — we are responsible, and this notice applies to it directly.

This website

This website sets no cookies, uses no analytics and loads nothing from other sites; its fonts are hosted with the site. If you choose a language, that choice is remembered in your own browser and is not sent to us.

Our web host, Cloudflare, may process technical information such as IP addresses to deliver the pages.

The demo request form

If you ask for a demo on our contact page, we collect what you enter: your name, email address, firm or business name, whether you are a bookkeeping firm or a business owner, the number of client files and your message. We use it only to answer your request.

The request is emailed to our inbox through Resend, an email service based in the United States, so it may be processed outside Canada. The anti-spam check runs in your browser; it uses no cookies and no third-party service. We keep a request only as long as we need it to follow up.

What the service collects

• Account information: your firm’s name, your name, email address, password and language. For people you invite: their email address, role and the clients they are assigned to.
• QuickBooks data: when a bookkeeper connects a client file through Intuit’s sign-in, we keep a full copy of its QuickBooks records and keep it in sync. This includes the company’s information, including its address (used to find its province); the chart of accounts; tax codes, rates and agencies; customers and vendors, with the names, addresses, emails and other contact details recorded in QuickBooks; items, classes, departments, terms and payment methods; and transactions: purchases, bills, invoices, sales receipts, journal entries, deposits, payments, bill payments, credit memos, vendor credits, transfers and refund receipts. We copy 12 months of transactions. For each transaction we also keep a summary for search: date, document number, customer or vendor name, total, currency, memo and accounts. The books can include personal information about the client’s customers, vendors, employees and others named in them.
• Intuit connection: the sign-in tokens Intuit issues for each connected client file, stored encrypted.
• Your work in the service: drafts, approvals and rejections, rules, answers to questions, review summaries, exports and settings.
• Activity log: a record of who did what and when, including the details given for each action.
• AI assistant connections: which person connected which AI app (Claude or ChatGPT) to which firm. Connection tokens are stored only as hashes.
• Billing: card payments go through Stripe’s checkout and billing portal. We keep your billing status and the number of connected client files.
• Logs: technical logs needed to run and secure the service.
• Cookies in the app: the app sets one cookie, which keeps you signed in.

Why we use it

• To run the service: sync client files, run the sales-tax review and clean-up checks, prepare drafts and write approved changes to QuickBooks.
• To let each bookkeeper connect their own AI assistant, and to apply your firm’s client restrictions everywhere, including in that assistant.
• To send service emails: email confirmation, invitations, password resets, billing notices and deletion warnings.
• To bill your firm, and to keep the service and its data secure.

We do not sell personal information or use it for advertising.

Where it is stored

In Canada. The app server and each firm’s live database are at OVHcloud’s data centre in Beauharnois, Québec. Encrypted backups are kept at OVHcloud in Beauharnois, Québec.

Our service providers (subprocessors) are:

• OVHcloud: hosting of the app, the firms’ databases and the encrypted backups, in Beauharnois, Québec.
• Resend: sending the app’s emails.
• Cloudflare: serving this website.
• Stripe: card payments and billing. Stripe receives billing data only.

Our data processing agreement lists them for firms and explains how we tell firms about a change. We will tell firms by email before we add or replace a subprocessor.

Intuit (QuickBooks Online), Anthropic (Claude) and OpenAI (ChatGPT) are not our subprocessors. Your firm connects its clients’ files through Intuit’s sign-in, and each bookkeeper chooses to use their own AI assistant.

What leaves Canada

The app has no AI chat of its own. When a bookkeeper uses their own AI assistant, the data it reads is sent to that bookkeeper’s account with its provider, under their agreement with Anthropic (for Claude) or OpenAI (for ChatGPT). That data leaves Canada. Your firm decides who connects an AI assistant, and can restrict each bookkeeper to their assigned clients.

The app’s emails (sign-up confirmations, invitations, password resets, billing notices and deletion warnings) are sent through Resend, an email service based in the United States, so an email’s contents, including the recipient’s address and name, the firm’s name and the message, may be processed outside Canada.

Stripe may process billing information outside Canada, under its own privacy policy.

How long we keep it

• While your firm is active, we keep its data so the service works.
• If a trial ends without a card, a subscription is unpaid or your firm cancels, the firm becomes read-only. We send warnings on day 23 and day 29, and delete the firm on day 30. You can export your data until then.
• A disconnected client file stops syncing; its copied data is deleted after 30 days unless it is reconnected.
• Deleting a firm destroys its encryption key. Its backups become unreadable within 35 days.
• We also delete data on your firm’s request.
• Logs: kept only as long as needed for that purpose.

How we protect it

• One database per firm. A bookkeeper restricted to some clients can’t reach the others by any path, including their AI assistant.
• Each firm is backed up, encrypted with its own key. Backups are kept 35 days.
• Intuit sign-in tokens are stored encrypted. Intuit and payment keys are kept out of the code, and bookkeepers never see developer keys. Intuit and Stripe keys are stored on the server in files only its administrator can read, and are given to the app as Docker secrets.
• AI assistant connection tokens are stored only as hashes.
• AI assistant access tokens last one hour and are rotated; a reused token revokes the connection.
• Nothing is written to QuickBooks until a bookkeeper approves it.

Your rights

Under Law 25 you can ask to access the personal information we hold about you, to correct it, to withdraw your consent, and to receive it in a structured, commonly used technological format. We answer within 30 days.

If your information is in a client’s books, your request is best sent to the bookkeeping firm responsible for those books. We help the firm answer it, as set out in our data processing agreement.

If you are not satisfied with our answer, you can complain to the Commission d’accès à l’information du Québec.

Contact

Our person in charge of the protection of personal information can be reached at info@getcosigne.com.

Changes to this notice

We will post any change on this page with a new effective date. If a change is significant, we will tell firms by email before it applies.