Security & data handling

Your financial data, handled the way you would want your own to be.

Connecting a store, payment processor and accounting system means trusting someone with sensitive commercial information. This page explains exactly what LZ Financial accesses, what it never asks for, how the automation actually works, where any AI fits, and how the data is stored, retained and deleted.

Least-privilege accessNo credentials in forms or emailHuman-reviewed exceptionsClient data never trains AI models
Access

What we access — and what we never ask for.

The service is designed around data minimization: we request the narrowest access needed to reconcile your payouts, and nothing more. Sensitive credentials never travel through ordinary forms or email.

What we connect to

  • Read access to your storefront and payment-processor reports (Shopify, Stripe, PayPal and similar) so payouts, fees, refunds and disputes can be traced.
  • Scoped access to the specific accounting system you authorize (QuickBooks Online, Xero) to post reconciled entries.
  • Business contact details and a high-level description of your workflow during assessment.

What we never request

  • Bank, card or online-banking passwords or login credentials.
  • API secrets, one-time codes or full payment-card numbers.
  • Personal information that is not needed to deliver the service.

Connections are made through each platform's official authorization, so access is granted with defined permissions and can be revoked by you at any time — no shared passwords.

Public assessment forms are limited to business contact information. After a verified payment, onboarding uses an opaque, time-limited link rather than an open form. If a request ever seems to ask for a password or banking credential, it is not from us — stop and email info@lzfinancial.ca.

Technology transparency

How the automation works, and exactly where AI fits.

"AI bookkeeping" can mean very different things, so here is the honest breakdown. The bulk of the work is deterministic and auditable. A machine-learning model is used only in a narrow, supervised role — and it is never allowed to post to your books on its own.

Deterministic — the majorityRules, matching and reconciliation logic

Pulling settlement reports, grouping the transactions behind each payout, applying your agreed categorization and clearing-account rules, and matching the net settlement to the accounting entry and the bank deposit. This is ordinary, repeatable software: the same inputs always produce the same, traceable output.

AI-assisted — the narrow partSuggestions for ambiguous items

When a transaction description or category is genuinely unclear, a model may suggest the most likely mapping to speed up review. Suggestions are surfaced as exceptions for a person to approve or correct — they are not applied automatically, and confirmed mappings become deterministic rules going forward.

Your data is never used to train AI models

Any AI-assisted step is used solely to deliver your reconciliation. Your financial data is never sold, and it is never used to train, fine-tune or improve any AI model. Categorization suggestions exist only to speed up review, and a person confirms them before anything is recorded to your books.

Nothing posts without a human in the loop

Missing mappings, unusual refunds, disputes and holds are routed for review rather than silently forced through. You remain responsible for reviewing outputs and approving mappings, and for professional advice on material accounting and tax decisions.

Sub-processors

The service providers that may process data for us.

We keep this list short and current. Data may be processed outside Alberta or Canada and may be accessible to authorities under the laws of those locations. We do not sell personal information.

ProviderPurposeWhat it may handle
CloudflareWebsite hosting & securitySite delivery, security logs, onboarding database
StripePaymentsBilling details; we never receive full card numbers
Resend & Google WorkspaceEmailCorrespondence and notifications
CalendlyDemo bookingName, email and meeting details you provide
Client-authorized platformsBookkeepingThe Shopify / Stripe / PayPal / accounting data you connect

This mirrors the providers named in our Privacy Policy. If the list changes, both pages are updated.

Retention & safeguards

Storage, retention and deletion.

Encryption

Data is transmitted over encrypted connections and protected with access controls and secret management appropriate to its sensitivity. The site is served over HTTPS only.

Retention

We keep information only as long as reasonably necessary for the service, security, dispute resolution and legal, accounting or tax obligations.

Access revocation & deletion

You can request revocation of platform access at any time when an engagement ends. Working records are otherwise retained for approximately 10 years, consistent with accounting and tax record-keeping obligations, unless you specifically request earlier deletion.

Safe rollout

How we connect your systems, step by step.

You never have to hand over production access on day one. Access is introduced in stages, and an opening period is validated before anything is relied upon.

1 · Assess with no credentials

Start with the free diagnostic or an assessment using only business contact details and a description of the problem.

2 · Least-privilege connection

Connect through each platform's official authorization with read or scoped access — using a test or sandbox environment first where the platform supports it.

3 · Validate an opening period

Trace one complete period from source reports through the processor balance, accounting records and bank settlement before go-live.

4 · Go live with exceptions visible

Only routine, validated activity flows automatically; genuine exceptions stay surfaced for your review.

Questions about security before you connect anything?

Ask before you share access. We are happy to walk through scopes, sub-processors and deletion in a short call.

Email info@lzfinancial.ca →