Privacy policy

WorthGraph is a financial-life management platform operated by Tapforce LLC ("we", "us"). This policy explains what we collect, why, who can see it, how we protect it, and how to get it back or have it erased.

It applies to the WorthGraph web application at app.reziduals.com and to the background jobs that keep your connected accounts in sync. Questions, requests and complaints all go to support@reziduals.com, and a person answers them.

WorthGraph is not affiliated with, endorsed by, or sponsored by Intuit Inc. QuickBooks and QuickBooks Online are trademarks of Intuit Inc.

Information you give us when you create an account and use the service:

• Your name, email address and the authenticator app or passkey you register as a second factor.
• The records you build in WorthGraph: entities, people, accounts, liabilities, transactions, documents, books and tax records.
• Sensitive identifiers you choose to store — Social Security numbers, ITINs, EINs, and full account, card and routing numbers. These are encrypted before they are written down and are masked everywhere in the interface until you deliberately reveal one.

Information from services you connect, and only after you authorize the connection:

• QuickBooks Online. We request the accounting scope (com.intuit.quickbooks.accounting) and nothing else. Within it we read your chart of accounts, transactions and journal entries, and your company profile, and we write back the changes you make in WorthGraph. We also store the company (realm) identifier and the OAuth access and refresh tokens that let us do so. We do not request or receive payroll or payments data.
• Bank and card accounts you link through Plaid, and Mercury business banking, on the same principle: only what the connection you authorized returns.
• Documents you upload or email in — including the text we recognize inside them.

Information the software records about itself:

• An append-only audit trail of who did what and when — sign-ins, permission changes, connections, document downloads, and every reveal of a sensitive value.
• Your IP address and browser, recorded with your sign-ins, and your IP address when you accept these documents.
• Operational logs and error reports. Secret fields are removed before an error report leaves the application.

We use your information to operate WorthGraph: to show you your financial position, to keep connected accounts in sync, to produce books and reports, to process the documents you give us, to authenticate you, to notify you about your own account, and to investigate problems you report.

We want to be unambiguous about the things we do not do, because these are the questions worth asking of anyone holding this data:

• We do not sell your information, and we do not share it with anyone for their own marketing.
• We do not use your information, or anything we receive from QuickBooks Online, for advertising or ad targeting.
• We do not use your information, or anything we receive from QuickBooks Online, to train machine-learning models, ours or anyone else’s. Every AI request is routed only to a provider that has agreed not to train on it.
• We do not combine one customer’s data with another’s, and we do not build cross-customer profiles or benchmarks from it.

Your data belongs to your workspace and is visible only inside it. Each workspace is isolated at the database level as well as in the application, and every request a person makes is scoped to their workspace. Background jobs work one workspace at a time.

Four categories of people can see a given record, and no others:

• You, and the people you invite to your workspace — each limited to what their role permits.
• An accounting firm, but only under a grant, and only for what that grant covers. You can give a firm a grant yourself. If a firm set up your workspace for you, it starts with one: it is the owner until you claim the workspace, and then keeps the role it chose. You can revoke a grant at any time; access ends immediately. Notes the firm wrote for itself stay with the firm and stop being visible to you.
• An emergency contact, if someone in your workspace named one. If the person they watch stops signing in, the contact is told every day through a waiting period, and is then let in to read the whole workspace, without changing anything.
• Our staff, when it is necessary to operate the service or to answer a support request you raised.

Staff access is not all on one trail, so here is the difference exactly:

• Inside the application, we have no way to sign in as you or to open your workspace.
• The operator tools we run against a workspace, such as creating a firm or closing a workspace, write to the audit log and name the operator.
• Consoles are different. Running the service means holding accounts at our hosting, database and cloud providers, and those accounts are held by the owner of Tapforce LLC. Someone using a console works outside the application, so what they do there is not part of your audit trail: reading data leaves no entry in it, and a change is not attributed to a person in it. At the database, encrypted values read as ciphertext; everything else, such as names, balances and transactions, is readable.
• AWS keeps its own record of each use of the master key. That record is separate from your audit trail, and you cannot see it in the application.

We disclose information to a government or law enforcement body only where we are legally required to, and we will tell you unless we are prohibited from doing so.

WorthGraph can use AI to read documents, suggest transaction categories, match records to one another and, where the client assistant is on, answer a client’s questions about their own records. This is a per-workspace setting and it is off by default. There is no switch for it in the application yet: we turn it on for a workspace. While it is off, no document content and no transaction data is sent to any AI or OCR provider — the request is refused before a provider is even contacted, and the refusal is recorded.

When it is on, this is exactly what happens:

• Text recognition runs inside our own application, on our hosting provider. Document images and the text recognized from them are not sent to any recognition service.
• Before any document text is sent to an AI provider, Social Security numbers, ITINs, EINs and long account and card numbers are masked out, keeping only the last four digits. The remaining content — which is the substance of the document — is what the provider sees.
• Transaction data, including transactions synced from QuickBooks Online, may be sent to an AI provider to propose a category or a match.
• A person does not always review the result. A document match or a category the model is very sure of can take effect without anyone reviewing it; anything less sure is flagged for a person. Either way it stays marked as an AI decision, and you can change it.
• The client assistant reads a client’s own records through a fixed set of read-only tools. It cannot change or send anything, and a message containing a Social Security number, EIN, ITIN or full account number is refused before it leaves our server. It runs only while the workspace keeps conversations, which are stored encrypted in our database under your retention period.
• Every AI request is sent with zero data retention required. The gateway and the model provider have agreed not to keep the prompt or the answer after the request and not to train on them, and if that cannot be honoured for a request, the request fails rather than going ahead. A provider may still handle a request it flags for abuse or safety review under its own terms.
• Every AI run is recorded in your audit trail: what was attempted, whether it was allowed, and how it ended. The words themselves are not kept there.

The identifiers stored in WorthGraph’s encrypted fields are never sent to an AI provider under any setting. Identifiers printed inside a document are masked by software, which refuses a page it cannot account for; that is a strong check and not an absolute guarantee. Turning the setting off stops all of this immediately for your workspace, until it is turned on again.

We use a small set of providers to run WorthGraph. This is what each one is for:

• Vercel — application hosting and compute. Everything you see in WorthGraph is served from it.
• Neon (Databricks) — the database. Hosted in the United States (US East, Ohio).
• AWS — encrypted document storage (S3) and the master key (KMS). Hosted in the United States (US East, Ohio).
• Fly.io — the host of our virus scanner. Every file you upload or email in passes through it, over an encrypted connection, before it is stored.
• Vercel AI Gateway — routes AI requests to the model provider, when AI is on for your workspace. It is told to use only a provider that has agreed to zero data retention.
• Anthropic — the AI models, reached only through Vercel AI Gateway and only when AI is on for your workspace.
• Vercel Workflow — holds a client assistant session while it runs, for up to 24 hours, when the assistant is on for your workspace. This copy is not under your workspace key.
• Inngest — the scheduling of background jobs such as overnight syncs. It receives record ids and counts, not document content.
• Resend — outbound email, and the inbound address you can forward documents to.
• Google — the support@reziduals.com mailbox (Google Workspace). What you write to us, and our replies, are held there, outside the application.
• Sentry — error monitoring, on our servers and in your browser. It receives errors only, with no session replay, and secret fields and the query part of web addresses are removed before a report leaves.
• Supabase — our previous database host. It keeps a frozen, read-only copy from 2026-10-23, which nothing reads, until we delete it; that is scheduled from 2026-11-23. Hosted in the United States (US East).
• Intuit, Plaid and Mercury — the financial services you choose to connect. Data flows to and from these only because you authorized the connection.

Your records and documents are stored in the United States. Not every provider above is pinned there: an AI request in particular may be processed in any region the gateway selects. If you are outside the United States, using WorthGraph means your information is transferred to the United States and may be processed elsewhere.

Security is a design constraint here rather than a policy statement, so these are properties of the system rather than intentions:

• Sensitive values — identifiers, full account numbers, connection tokens, recognized document text and extracted fields — are encrypted before they are stored, with a key unique to your workspace. The encryption is bound to the exact record and column it belongs to, so ciphertext moved somewhere else does not decrypt.
• The key that protects those keys is held in a managed key service (AWS KMS), separate from the database; it never leaves that service. Each workspace key also has a recovery copy, sealed to a separate recovery key that is held offline, in shares, so that your data can be recovered if AWS is ever lost.
• Every page that shows your data requires a signed-in session and a verified second factor. Revealing a sensitive value requires you to have proved that factor again within the last few minutes, and the reveal is written to the audit trail.
• Your browser never holds a database credential. Every read and write goes through our server, which applies your permissions; the database enforces workspace isolation independently as a second line of defense.
• Traffic is encrypted in transit.
• Audit records are append-only. Nobody can change or delete them through the application, and the database itself refuses to update, delete or empty the audit log for every role, including ours. That protection has limits: someone holding our database owner’s credential could deliberately remove it, which leaves a trace in our code review if done through a migration, and otherwise only in the database provider’s logs; restoring a backup brings back what that backup held; and the log is not cryptographically sealed, so it does not by itself prove that no entry was added.
• We do not log request bodies, records, or tokens, and secret fields are removed from error reports.

No system is perfect. If we discover a breach affecting your information we will notify you without undue delay, and describe what happened and what we are doing about it. Security issues can be reported to support@reziduals.com.

You can disconnect QuickBooks Online from inside WorthGraph, on the page for the set of books it is connected to. When you do:

• We tell Intuit to revoke the authorization, and the access and refresh tokens we hold are erased from our database. We cannot reach your QuickBooks company again without a fresh authorization from you.
• All syncing stops immediately, in both directions. No further data is read from or written to QuickBooks Online.
• The disconnection is recorded in your audit trail.
• Records already synced into your workspace remain there, because they are now part of your books and deleting them would destroy work you have done. You can delete them yourself, or close your workspace, which removes them as described below.

You can also remove WorthGraph from the My Apps page in QuickBooks Online. Intuit then revokes our access: the tokens we hold stop working, nothing more can be read from or written to your QuickBooks company, and the next time we try to reach it the connection shows in WorthGraph as needing reauthorization. The revoked tokens stay encrypted in our database until you disconnect inside WorthGraph or your workspace is closed, and either of those erases them.

Reconnecting is the same flow as connecting the first time, and requires you to authorize again.

We keep your information for as long as your workspace is open, and then only as described here.

• Export. A workspace owner can export everything in the workspace — records and documents — at any time, after re-proving their second factor.
• Deletion. Most records soft-delete first: they leave your lists and stay in the database, and a deleted document can be restored. A nightly job removes them for good once your workspace’s retention period has passed since they were deleted. That period is seven years unless your workspace sets another.
• Permanent deletion of a document. A workspace owner can destroy a document already in the trash, after re-proving their second factor and typing a confirmation, unless it belongs to a tax return, is marked immutable, or its file is under a retention lock. The file leaves the application at once, and its remaining stored versions expire within 30 days.
• Filed returns. A filed tax return cannot be altered or deleted, because it is a record of something that happened.
• Audit records. They are kept for as long as WorthGraph runs, including after a workspace closes, because a security trail that can be trimmed is not a security trail. They hold a before and after image of each change. Values we encrypt are masked in those images and nothing else is, so names, note text and drafted messages can remain readable there after the record itself is deleted.
• Backups and provider logs. Data removed from the live database can remain in our database provider’s history and snapshots until they age out, and in our providers’ logs and error reports for as long as those providers keep them.

Closing your workspace. A workspace owner can request closure on Admin › Settings, or write to support@reziduals.com. We carry it out within 30 days of the request and offer an export first, because that is the last chance. The workspace keeps working until then. When we close it:

• Access ends: every seat, every waiting invitation, every firm’s grant and every session in that workspace. A firm keeps the internal notes it wrote.
• Connection tokens are destroyed, and connections are revoked at Plaid and QuickBooks where they answer. Mercury gives us no way to revoke a token, so that one is cut in Mercury’s own dashboard.
• Sign-in credentials are removed for each person the closure leaves without a workspace: password, passkeys, authenticator factors, recovery codes and sessions. Someone who still has a seat in another open workspace, or an invitation that can still be accepted, keeps theirs.
• Your records are removed: accounts, transactions, documents, people, entities, notes, books, plans, assistant conversations, net-worth snapshots and drafted messages. Your stored files leave the application at once, and their remaining stored versions expire within 30 days.

Some things survive a closure, and you should know what they are and for how long:

• Filed returns: the return, its versions and lines, the payments made against it, the files they name, the person or entity that filed it, and the key that opens them. They stay encrypted, and no person, firm or job can reach them, until the retention date we record at closure, which is at least your retention period after the latest filing. Nothing removes them automatically. After that date we remove them ourselves, in a reviewed change, once the file’s retention lock has run out.
• The audit trail, for as long as WorthGraph runs. Values we encrypt are masked in it and nothing else is, so names, note text and drafted messages written before the closure stay there in readable form. Nobody can open it in the application after a closure, but it stays readable at the database.
• Members’ email addresses, for as long as WorthGraph runs, because the audit trail refers to them. The address stays on an account with no credentials and no workspace.
• The workspace’s name and the record of its closure, for as long as WorthGraph runs. A firm’s own grant history and notes refer to the name.
• Operational logs, for as long as WorthGraph runs: the records that AI runs, syncs, knowledge lookups and reopened periods happened. Text and pointers to your records are cleared from them at closure, so they hold no client content.
• What you agreed to and who could reach the workspace, for as long as WorthGraph runs: consents, revoked grants and membership records.
• Mail you exchanged with support@reziduals.com, which stays in that mailbox. We have not set a retention period for it.

To export, delete, correct anything, or ask what we hold about you, write to support@reziduals.com. We will respond within 30 days. Depending on where you live you may have additional rights over your information; tell us which you want to use and we will respond within the same 30 days.

WorthGraph is a tool for managing financial affairs and is not directed at children. We do not knowingly collect information from anyone under 18. A workspace may contain information about a child — a dependent on a tax return, for example — which is information about them provided by you, not collected from them.

We will update this page when the way we handle information changes, and we will change the date at the top when we do. If a change materially reduces the protection your information gets, we will tell you before it takes effect rather than after. When the date changes, we ask you to accept the new version before you reach your data again. The current version always lives at app.reziduals.com/privacy.