Security and data handling
Health metadata only
Section titled “Health metadata only”Cadence collects Windows event counts, version strings, service states, network metrics and file sizes. It never reads, transmits or stores:
- company-file contents (
.qbw), transactions, customers, payroll or any financial data - credentials, documents, screen contents or keystrokes
Company-file names are deliberately discarded — they can carry customer or matter identifiers. Only sizes and ratios are kept.
The only file the agent ever writes is QuickBooks’ own update-channel config, and only the
background-update flag, only under lock policy, and only after taking a verified backup.
Credentials
Section titled “Credentials”| Credential | Held by | Scope | Stored as |
|---|---|---|---|
| Enrollment token | the installer, briefly | create devices for one site | SHA-256 hash |
| Device credential | one agent | write telemetry for its own host only | SHA-256 hash |
| Status token | the customer | read-only, one site | SHA-256 hash |
| Operator key | the operator | full console | platform secret |
Plaintext is shown once at creation and never persisted server-side. Rotation replaces the hash. A device credential may only report for the host it was issued to; a revoked credential is refused outright.
Transport and API
Section titled “Transport and API”HTTPS only. Rate limits applied after authentication and keyed to the authenticated site. A true byte cap on request bodies, aborted mid-stream. Strict input validation with numeric clamping and string truncation. Server-side timestamps, so an agent cannot backdate a sample. Security headers on every response. Bound SQL parameters throughout, and escaped HTML output.
Endpoints return one generic 401 for a bad site, an unknown site, a missing token and a wrong
token alike, so site identifiers cannot be enumerated.
Retention
Section titled “Retention”Samples are pruned on a schedule (default 90 days), which bounds storage and limits the blast radius of any future disclosure.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Email support@freezeframe.solutions. Please do not open a public issue.