Privacy policy

Who we are

GitsTel Inc. ("GitsTel") is a managed service provider. Ops is GitsTel's own internal operations tool: it is used only by GitsTel's staff, in their work, and it connects to one QuickBooks Online company - GitsTel's own. GitsTel is responsible for Ops and for this policy; how to reach us is at the end.

This policy covers what Ops reads from GitsTel's QuickBooks company and what it does with it. Ops's billing with QuickBooks is being built in stages from October 2026. This policy says what Ops does today and, for each part still being built, what it will do once it is in use.

What Ops reads from QuickBooks, and why

Today Ops reads the company when an owner connects it or checks the connection, reads its items and customers when a GitsTel person with billing access checks or refreshes them in Ops, or a GitsTel owner with billing access checks or refreshes them at the console of Ops's server - a check reads them and says what a refresh would change, without changing them - and reads how the company is set up when an owner runs Ops's diagnostic command (below). As billing is built, Ops will read the rest of what is named here. It keeps only the fields named, never a whole record as QuickBooks sent it.

• The company: its id, so that every request goes to GitsTel's own company and no other, and its name, shown to the owner who has just connected or checked the connection. Ops keeps the name only in the diagnostic report below.
• Items: their id, name, type, income account, whether active, and price - so the work and equipment Ops records are billed as the right QuickBooks items. Ops keeps no category of items.
• Customers: id, display name, parent, whether active, whether billed with their parent, whether a project, and preferred delivery - so each of GitsTel's clients is billed as the right QuickBooks customer, and so clients' names in Ops can follow QuickBooks's.
• Invoices: ids, numbers, dates, statuses and totals - so Ops can record what it billed, and see whether an invoice it made has been sent, voided or deleted.
• Recurring invoices: the quantities on each client's, so the monthly device counts can be checked and kept current.

Ops's diagnostic command

Before billing is built on GitsTel's company, a GitsTel owner runs a command at the console of Ops's server, which is reached only from GitsTel's office. It reads how the company is set up - its settings, items, customers, invoices and recurring invoices - and reports it in counts and kinds: how many invoices there are, by whether they have been sent; how the recurring invoices are scheduled; how deep the customers go. The report also gives the company's name, country and QuickBooks edition, and GitsTel's own customer records, by name and id. It never shows a client's name, an amount, a note or an email address.

The report is shown on the owner's screen, and the owner may save it to a file on the server to read it back, readable only by the server account that ran the command. Each run is recorded in Ops's audit trail under the owner who ran it, with its counts and never a name.

In Intuit's sandbox - a test company Intuit provides, which holds nothing of GitsTel's or its clients' - the command can also try one change: it raises one quantity on a recurring invoice by one, reads it back, and tries to put it back as it was, reporting anything QuickBooks changed besides and anything it did not put back. Ops refuses that trial on any other company.

What Ops writes to QuickBooks, and why

Today Ops writes nothing to GitsTel's QuickBooks company. Its one write so far is the diagnostic command's trial in Intuit's sandbox, above. As billing is built, Ops will write:

• Invoices for GitsTel's clients, for the work and equipment recorded in Ops, and further lines on a client's invoice not yet sent. Each line will carry a customer, an item, a quantity, a price and a description - never a cost or a markup. The description will name what is billed: the equipment, or the date of a visit and the GitsTel staff who attended it. It is part of the invoice in QuickBooks, and goes with it wherever the invoice is sent.
• The monthly counts a GitsTel person has approved - workstations, tablets and servers - into a client's recurring invoice, or into that month's invoice made from it. Nothing else from Ops's device records will go into the recurring invoices; the details stay in Ops.

Ops never sends, emails or prints anything from QuickBooks, never voids or deletes anything there, never gives QuickBooks a recipient, never creates a customer or an item, and never changes how or when a recurring invoice is sent. Where a recurring invoice is set in QuickBooks to send itself, QuickBooks will email it to the client on its own schedule, with the counts Ops wrote.

When Ops reaches QuickBooks

Only while a GitsTel person is doing something in Ops - connecting it, checking the connection, checking or refreshing its items or customers and, once billing is built, billing - or a GitsTel owner is running the diagnostic command or the command that checks and refreshes its items and customers. Nothing reaches QuickBooks on a timer or from a background process. Ops counts its reads each month and stops itself at half of the limit Intuit sets.

Who sees it in Ops

Today the connection itself - who connected it, when, and whether it has stopped - is shown to the owners; QuickBooks's items to staff an owner has given billing access, person by person, and the name of the item each product code is billed as, and whether QuickBooks has made it inactive or no longer has it, to all GitsTel staff, beside the code on an asset's page and the list of product codes; and QuickBooks's customers to staff with billing access and to the owners. As billing is built, the rest of what Ops keeps from QuickBooks will be shown only to the GitsTel staff whose work needs it:

• invoices, their lines and the monthly counts, to staff with billing access;
• invoice numbers, and whether a piece of work has been billed, to them and to GitsTel's procurement specialists, managers and owners.

Clients' names in Ops, which are to follow QuickBooks's customer names, will be seen by GitsTel staff wherever Ops shows a client. Every act is recorded in Ops's audit trail with who did it: connecting, disconnecting, each run of the diagnostic command, each refresh and check of QuickBooks's items or customers, in Ops or at the server's console, with how many it added, changed and found no longer in QuickBooks, or why it was refused, and never a name; each match of a product code, a kind of line or a customer; and, once billing is built, each invoice and each change. GitsTel's owners read the trail, which will name invoice numbers and, where a number was corrected, the reason given for the correction.

What Ops keeps, and for how long

What Ops keeps from QuickBooks is part of GitsTel's billing records and stays in Ops while GitsTel uses it. The device counts behind each recurring invoice will be kept as Ops counted them and never changed or deleted, so a question about an invoice can be answered later. No answer from QuickBooks is kept or logged whole; each request's Intuit tracking id is logged, so a call can be traced. A diagnostic report an owner saves to a file stays on the server until the owner deletes it, or the server clears it, if it was saved among the files the server keeps only until it next starts.

Ops's database is backed up every night. Each backup is sealed - encrypted to a key whose private half is kept offline - and kept for 7 years, and nobody can delete it for its first 35 days.

Ops's audit trail, which records who did what and cannot be edited, is also shipped off the server every day, sealed in the same way. GitsTel has set 365 days as how long each day's copy is kept, but the rule that deletes a copy at the end of that time is not yet in place; until it is, every copy is kept.

Where it is hosted

Ops runs on a server GitsTel rents from Vultr for Ops alone. Its sealed backups and audit trail are kept in Vultr's object storage in Atlanta, in a different datacentre from the server.

Who else handles it

GitsTel does not sell, rent or trade anything Ops holds, and uses none of it for advertising or marketing. Ops sends nothing to any analytics, telemetry or error-reporting service. What it reads from QuickBooks reaches only these services, each for what is named:

• Intuit, for QuickBooks Online: where the data comes from, and where the invoices and counts Ops will write go, once billing is built. Intuit's own privacy statement covers what Intuit does with it.
• Vultr: hosts Ops, and keeps its sealed backups and audit trail.
• Microsoft, through which Ops sends its email to GitsTel staff - that the QuickBooks connection has stopped, say, or how many clients have work waiting to be invoiced. These carry dates, counts and links back into Ops, never a client's name or an invoice's contents.
• Atera, which GitsTel uses to look after its clients' computers and support tickets: once clients' names in Ops follow QuickBooks's - still being built - Ops writes each client's name, as Ops then holds it, into the matching customer there. Nothing else from QuickBooks goes to Atera.
• Anthropic, whose AI assistant, Claude, GitsTel uses to build and run Ops: GitsTel staff working on Ops may show it, or have it read, what Ops holds from QuickBooks. Ops itself sends Anthropic nothing. Anthropic's own terms and privacy policy cover what Anthropic does with it.

How it is kept safe

• The authorisation Intuit gives Ops, its refresh token, is kept in Ops's vault, encrypted, in a folder the background processes that collect from GitsTel's other systems cannot open. It is opened only while a GitsTel person is doing something in Ops, or a GitsTel owner runs the diagnostic command or the refresh command at the console of Ops's server; nothing Ops runs on a schedule reads it. Ops keeps no access token: it asks Intuit for a new one before each request, or once for all the pages of one list.
• Which QuickBooks company Ops is connected to is kept encrypted too, in a table those background processes cannot read.
• Only a GitsTel owner can connect QuickBooks, from GitsTel's office, confirming it with a passkey. An owner gives billing access person by person, confirming each with the owner's own passkey. Once Ops creates invoices, adds lines to them and approves the monthly counts, which are still being built, it will require each to be confirmed with the passkey of the person doing it.
• No token is written to a log. Of what QuickBooks answers, Ops logs only which call it was, its status and Intuit's tracking id. Intuit's error message is never kept or shown; its error code may be shown to the person whose request it refused, and is recorded in the audit trail when Intuit refuses Ops a token.
• Ops is reached only over HTTPS, and its backups and audit archive are sealed to keys whose private halves are kept offline.

Disconnecting QuickBooks

An owner disconnects Ops from QuickBooks on Ops's QuickBooks page, under Administration. Ops then:

• asks Intuit to revoke its authorisation;
• takes the refresh token out of its vault, whether or not Intuit confirms, so that nothing in Ops can use it again;
• reads and writes nothing more in QuickBooks until an owner connects it again;
• records the disconnection, and whether Intuit confirmed it, in the audit trail.

If Intuit does not confirm, the page says so, and the owner removes Ops from the company's connected apps in QuickBooks. Removing Ops there works on its own too: Ops stops at its next use of the connection and tells GitsTel's owners.

What Ops already holds from QuickBooks stays, as part of GitsTel's billing records. The token's encrypted copy stays among the vault's deleted records and in the sealed backups, as every deleted secret's does, where nothing uses it.

Questions and requests

Questions about this policy, and requests about what Ops holds, go to:

Changes

GitsTel updates this policy when what Ops does with this data changes. The date at the top says when it last changed.