Security and data handling
Health metadata only
Cadence collects Windows event counts, version strings, service states, network metrics and file sizes. It never reads, transmits or stores:
- company-file contents (
.qbw), transactions, customers, payroll or any financial data - credentials, documents, screen contents or keystrokes
Company-file names are deliberately discarded — they can carry customer or matter identifiers. Only sizes and ratios are kept.
The only file the agent ever writes is QuickBooks’ own update-channel config, and only the
background-update flag, only under lock policy, and only after taking a verified backup.
Credentials
| Credential | Held by | Scope | Stored as |
|---|---|---|---|
| Enrollment token | the installer, briefly | create devices for one site | SHA-256 hash |
| Device credential | one agent | write telemetry for its own host only | SHA-256 hash |
| Status token | the customer | read-only, one site | SHA-256 hash |
| Operator key | the operator | full console | platform secret |
Plaintext is shown once at creation and never persisted server-side. Rotation replaces the hash. A device credential may only report for the host it was issued to; a revoked credential is refused outright.
Transport and API
HTTPS only. Rate limits applied after authentication and keyed to the authenticated site. A true byte cap on request bodies, aborted mid-stream. Strict input validation with numeric clamping and string truncation. Server-side timestamps, so an agent cannot backdate a sample. Security headers on every response. Bound SQL parameters throughout, and escaped HTML output.
Endpoints return one generic 401 for a bad site, an unknown site, a missing token and a wrong
token alike, so site identifiers cannot be enumerated.
Retention
Samples are pruned on a schedule (default 90 days), which bounds storage and limits the blast radius of any future disclosure.
Reporting a vulnerability
Email support@freezeframe.solutions. Please do not open a public issue.