QuickBooks Online · Read-only Pilot

Review receivables with accounting evidence. Engineering and real-account validation are separate. General connection is not enabled.

What CAVOA checks

Eligible invoices with positive balances at least 14 calendar days overdue, and past-due partial balances with supported allocated cash payments at least 14 days old. Recent payments suppress stale-payment findings. Zero balances and unsupported source states are excluded. Credits are already reflected in the balance and are never subtracted twice.

QuickBooks unapplied customer payments appear separately as reconciliation observations, without a recovered-revenue amount. Xero unallocated payment detection and public cross-system matching are deferred.

Minimum access and read-only behavior

QuickBooks Online uses the Accounting OAuth scope, which also permits writes at the provider. CAVOA enforces read-only accounting requests in its transport; we do not claim that Intuit grants a read-only token.

CAVOA reads company or organisation identity, invoices, payments and credit records; QuickBooks preferences establish the home currency. Customer/contact IDs are retained only as evidence references. Names, emails, invoice descriptions and private notes are not stored in reports or analytics.

Your connection

Owner approval binds an exact company or tenant and test/live mode for at most seven days. Authorize at the provider, confirm the approved company or tenant, then run a manual sync. Tokens are encrypted per workspace and rotated server-side. No accounting writes, invoice changes, payment creation, emails, recovery actions or money movement.

Coverage and health

USD, CAD, EUR, GBP, AUD and NZD. At most 500 records per resource and 40 logical reads within 55 seconds. Two matching normalized reads are required; this is not a transactional export. Partial, changing or unsupported data saves no new report. Revenue Health measures eligible receivables only; no overall score. Payment, subscription and full reconciliation health remain Not measured.

View coverage, source evidence, Action Center findings and manual sync history in your workspace. Review disputes, credits and newer payments in the source before following up. A falling balance never proves CAVOA recovered money.

Disconnect and privacy

Disconnect removes stored tokens and blocks further syncs, then attempts provider revocation. Xero disconnect targets the approved connection only. Confirm removal in the provider’s connected-app settings if revocation fails or authorization was interrupted. Reports remain until workspace deletion; hosting backup retention still applies.

View pilot access in your workspace · Use CSV now · Privacy · Ask about the pilot

What CAVOA can check · Multi-source synthetic examples · Synthetic watch-to-proof loop · Back to home