Security
Built to be trusted
with nothing.
Cadence runs inside accounting environments, so the security posture is the product. The design principle is simple: collect so little that a breach of Cadence would be boring.
Never collected
Not "not stored" — never read in the first place.
- Company-file contents (.qbw) — there is no code path that opens it
- Transactions, customers, vendors, payroll, or any financial data
- Credentials, documents, screen contents, or keystrokes
- Company-file names — deliberately discarded; they can carry client identifiers
What the agent ships
Health metadata, and nothing with a face on it.
- Version strings
- QuickBooks release + maintenance build, agent version
- Event counts
- crashes, freezes, forced shutdowns — counts, not contents
- Service state
- Database Server Manager up/down, hosting mode
- Network metrics
- latency, loss, SMB RTT, link speed, NIC flap counts
- File sizes
- company file and .TLG sizes and ratios — never names, never contents
Credential model
Every machine has its own key. Every key has one job.
There is no site-wide password to leak. A workstation enrols with a short-lived token, exchanges it for its own credential, and that credential can be revoked from the portal the moment the machine leaves — without touching the rest of the fleet.
| Credential | Held by | Can do exactly |
|---|---|---|
| Enrolment token | the installer, briefly | enrol devices for one site — then it expires |
| Device credential | one agent | write telemetry for its own host only; individually revocable |
| Status token | the client | read-only status for one site |
| Operator access | Freeze Frame staff | console behind identity-provider SSO at the edge |
Hardening
The unglamorous parts, done anyway.
- Credentials stored as SHA-256 hashes only — plaintext is shown once at creation and never persisted server-side
- HTTPS everywhere; security headers (CSP, nosniff, frame-deny, no-referrer) on every response
- Rate limits applied after authentication and keyed to the authenticated site
- Request bodies hard-capped by byte count and aborted mid-stream, not buffered then measured
- Strict input validation: hostname patterns, numeric clamping, string truncation
- Stored telemetry is a normalised, allowlisted snapshot — never the agent’s raw payload
- One generic 401 for every failure mode, so site names cannot be enumerated
- Server-side timestamps — an agent cannot backdate or race samples
- Raw samples pruned on a rolling window (90 days by default), bounding any disclosure
Read-heavy, write-careful
The agent writes exactly one thing.
Under lock policy — and only then — the agent edits a single flag in QuickBooks’ own update-channel config to stop unattended background updates. It takes a verified, dated backup first, writes to a temporary sibling, verifies the result, swaps atomically, and reports failure rather than claiming success. Everything else the agent does is read-only.
Want the full engineering detail — retention, rate-limit design, agent-side ACLs?