Security & data handling

OperatorIQ runs inside Microsoft Excel as an Office add-in. Your working models stay in your own Excel files, on your own machines and storage - they are not migrated into a proprietary platform.

What OperatorIQ stores on its servers, only when you use the corresponding feature:

• Versioned model snapshots - the assumptions, outputs, and the decision note (“the why”) you commit. Snapshots are compact reconstruction payloads, not copies of your workbook.
• Datasets you explicitly upload - detail tabs you choose to store, deletable from your account at any time.
• Connected financial data - when you connect QuickBooks, Square, or Xero, the synced financials used for your analysis.
• Account and billing basics - handled by Clerk (auth) and Stripe (payments); OperatorIQ never stores full card numbers.

• QuickBooks, Square, and Xero connect through each provider’s official OAuth. OperatorIQ never sees or stores your password - only an access token you can revoke at any time, from our side or the provider’s.
• OAuth tokens are encrypted at rest with AES-256-GCM (an Intuit security requirement we apply across providers).
• OperatorIQ reads your financials to build your analysis and never writes to your books. This is enforced in code, not just policy: the only write-capable endpoint is hard-gated to an internal allowlist, so no customer account can reach it regardless of any configuration.
• You can disconnect any integration at any time from your account.

• Every figure OperatorIQ reports is computed by a deterministic engine. The AI model only phrases the analysis, and its prose is validated against the engine’s numbers - any invented figure is rejected before you see it.
• On incomplete data the model abstains - it says it cannot tell, rather than guessing.
• Most analysis runs on OperatorIQ’s own fine-tuned models on infrastructure we control. Some structured phases use Anthropic’s API; relevant portions of your data are sent only to phrase or structure results, and Anthropic does not use API data to train models.
• Enterprise can run the model fully self-hosted, so financial data never leaves your environment for AI processing.

• Hosted in the United States. Data is encrypted in transit (HTTPS/TLS) and at rest.
• Authentication is handled by Clerk; sessions and API access are token-based. Password handling never touches OperatorIQ servers.
• A small set of subprocessors operates the platform (hosting, auth, billing, email, AI). The complete list, with what each handles, is maintained in our Privacy Policy - we give at least 14 days notice before material changes.

• Every model change is versioned with who made it, what changed, when, and why - a real audit trail, available in-product and writable into the workbook.
• Team plans scope models to your organization: shared version history, one canonical current plan, and role-based membership (builders and viewers).
• SSO (SAML / OIDC) is available on Team; SCIM provisioning and expanded audit logs on Enterprise.

• Datasets you upload are deletable from your account at any time. Disconnecting an integration stops the data flow immediately.
• After cancellation, your data remains accessible for 30 days and is then permanently deleted.
• Usage and AI query logs are kept for 12 months.
• For a data export or deletion request, email legal@myoperatoriq.com.

OperatorIQ is a young company and does not yet hold formal certifications such as SOC 2. We would rather tell you that plainly than imply otherwise. What we offer instead: this page, a subprocessor list that stays current, and direct answers - we complete security questionnaires for prospective customers, and Enterprise engagements include a security review with our team.

If you believe you have found a security issue, email help@myoperatoriq.com with “Security report” in the subject. We read every report and will respond promptly. Please do not test against accounts or data you do not own.