Security at VoiceQuote

VoiceQuote is designed around local review and least-necessary data movement.

Local app

The app binds its local service to the computer only. Browser requests use a per-launch token. Owner controls require a separate private code. Supported secrets are encrypted to the Windows account.

QuickBooks connection

VoiceQuote uses OAuth 2.0. The public HTTPS callback passes the authorization response to the local app. The app validates OAuth state before exchanging the code. Access and refresh tokens remain on the Windows account.

AI processing

Audio and transcripts are sent over HTTPS to OpenAI only to perform transcription and estimate extraction. The user reviews the result before it is sent to QuickBooks.

Reporting a concern

Submit security reports through the support form. Include a clear description and steps to reproduce. Do not include live customer audio, API keys, or QuickBooks tokens.