How your connected data stays private

Why this article exists

Connecting your accounting system, a business mailbox, a calendar, or a shared folder means handing Verinode a look at some of the most sensitive information in the business: the books, carrier and adjuster correspondence, meeting activity, customer and team details. Verinode is an independent data trust, and IQ is the Chief Data Officer working your side of it, not a carrier tool and not something that resells what you send it. Every wizard in Connect restates the same five-part promise in its own words, and this article pulls that promise into one place so you can see it applied consistently across every connection type instead of hunting for it wizard by wizard.

The five parts, in the order they show up on the page:

1. Read-only access. Nothing Verinode connects to can be written to, moved, or deleted.
2. You choose what we read. A folder, a label, a single Google Drive folder, a specific meeting. You draw the boundary, not Verinode.
3. Encrypted at rest, under a key scoped to you. Your identifying data is not sitting in a shared pool with every other operator's.
4. Never sold to carriers. Not a policy footnote, a line repeated in the actual consent checkbox you tick before connecting.
5. One-click disconnect. Disconnecting is a single click and a confirmation, and Verinode stops reading the source at once. What else a disconnect removes depends on the kind of connection.

Where you see this promise

Open Connect from the sidebar (/connect). Click the Integrations card to open the Integrations hub, the surface for every direct, provider-level connection: QuickBooks Online, Microsoft 365, Gmail, Microsoft 365 Calendar, Google Calendar, and the Verinode Notetaker. At the top of that panel, under the "Connect your tools." headline, a row of three pill labels always appears:

• Read-only access
• You choose what we read
• Encrypted at rest

That strip is not a one-time onboarding message. It sits above the tile grid every time you open the hub, and each provider's own setup wizard restates the same commitments in language specific to what that provider actually touches. The same five-part promise carries over to the two connection paths that live outside the Integrations hub: Connect a shared folder, further down the Connect page under Add a source, and Set up Flow on any tool card, where a human, not an API, is doing the pulling.

Read-only access, connection by connection

Nothing described below can send an email, move a calendar event, write a journal entry, delete a file, or change anything in the tool it connects to. Verinode reads; it does not act on your behalf inside these systems.

| Connection | What it reads | What it can never do | |---|---|---| | QuickBooks Online | Invoices, receivables, payments | Write to your books | | Microsoft 365 (mailbox) | Business mail in the folder you scope | Send, delete, or modify anything in your mailbox | | Gmail (mailbox) | Business mail in the label you scope | Send, delete, or modify anything in your mailbox | | Microsoft 365 Calendar | Meeting times and titles | Create, move, or change any event | | Google Calendar | Meeting times and titles | Create, move, or change any event | | Verinode Notetaker | Meetings it is added to | Read your wider calendar or account | | Shared folder (Google Drive) | Files in the one folder you share | See anything else on your drive |

The QuickBooks explainer states it plainly the moment you open that tile: "We never write to QuickBooks, and your financials are never sold to carriers." The mailbox wizard is just as direct: "It is strictly read-only. We never send, delete, or change anything in your mailbox." The calendar wizard mirrors it for meetings: "We never add, move, or change anything on your calendar." The Notetaker explainer covers the recording path the same way, reading only the meetings it joins, "never your wider account."

You choose what we read: scope is yours to draw

This is the part operators usually ask about first, because a mailbox or a hard drive holds a lot more than business records. Every connection that could plausibly over-read is built so you draw the line, not Verinode.

Mailbox connections (Microsoft 365, Gmail). Before you connect, the wizard walks you through creating a dedicated folder or label, for example "Verinode," and a rule that automatically routes carrier, TPA, and vendor mail into it. You then point the connection at that exact folder or label, and Verinode reads only what carries it, nothing else in the mailbox. If you leave the scope field blank, Verinode reads the whole mailbox, but even then it still only processes messages carrying a business attachment or coming from a known carrier, TPA, or vendor, never personal mail either way. If you want tighter control still, the wizard suggests connecting a dedicated mailbox, such as claims@yourcompany.com, instead of a personal inbox, so only that mailbox's folder or label is ever in scope.

You cannot connect a mailbox without agreeing to a specific consent statement first. The checkbox reads back exactly what you are about to authorize, echoing the folder or label name you typed:

"I understand Verinode will read [app] mail in my '[folder/label]' [folder/label] on a read-only basis, going back [N] days, keeping only messages with a document and their replies, encrypted under a key scoped to me and never sold to carriers, and that disconnecting deletes the mail Verinode kept."

The Connect button stays disabled until that box is checked.

Shared folder. You share exactly one Google Drive folder, Viewer-only, with the Verinode service account, and Verinode reads what lands in that folder and nothing else on your drive. See connecting a shared folder for the two-step handshake that proves you control the folder, not just its web link.

Verinode Notetaker. You decide which meetings it joins. It is added per meeting, joins under a visible name so the room always knows it is there, and reads only that one meeting, never a standing recording of everything on your calendar.

Flow-assigned tools (no direct connection). For a tool with no API to connect to, such as an estimating platform or a desktop accounting package, you choose the cadence data comes in on (Monthly, Quarterly, Weekly, or One time) and who pulls it, either yourself or a data contributor. Nothing about a Flow assignment reads anything automatically; a human still exports and uploads or forwards the file. See setting up Flow for a tool for the full walkthrough.

Encrypted at rest, under a key scoped to you

The identifying parts of what flows in through any of these connections, customer and adjuster names, claim details, street addresses, free-text notes, are column-encrypted under your own Vault Key, not a key shared across every operator on the platform. Your dollar figures, dates, and reference numbers live in a database that is yours alone. No other operator, and no carrier, can read either.

Verinode's automated systems can decrypt your data to do the work you actually asked for, running extraction on a forwarded invoice, matching a vendor, feeding a benchmark, including background processing that runs while you are offline. No Verinode employee browses or exports it through any tool the company operates, and every one of those automated accesses is logged for you to see. This is deliberately not a claim that Verinode is technically locked out of your data; it is a claim that access is scoped, automated, and auditable. The full mechanics, including how to reveal your own Vault Key, live in your Vault Key: how invoice data is encrypted.

Meeting titles read by a connected calendar are encrypted the same way: "Meeting titles are encrypted at rest," the calendar wizard states, alongside the same commitment that nothing is sold to carriers.

Never sold to carriers

This line is not a footnote buried in a policy page. It is written into the actual consent you tick, wizard by wizard:

• Mailbox: the consent checkbox itself: "...encrypted under a key scoped to me and never sold to carriers..."
• Calendar: "Meeting titles are encrypted at rest. We never request permission to create or change events, and your data is never sold to carriers."
• Verinode Notetaker: "Recordings are encrypted, never sold to carriers."
• QuickBooks: "We never write to QuickBooks, and your financials are never sold to carriers."
• Shared folder: "As with every source that feeds Verinode, this data is never sold to carriers."

This holds for the anonymized side of the platform too. Peer benchmarks are built from aggregated, hashed contributions across a group of operators large enough that no single contributor can be identified, never from a named operator's raw figures, and never handed to a carrier as raw or attributable data.

One-click disconnect

Every connection disconnects with one click and a confirmation, and Verinode stops reading that source the moment you confirm. What happens to what it already took in is not the same for every kind of connection, so here it is kind by kind. The confirmations quoted are the ones in the Integrations hub, and a row on the Connect page asks the same one. In every case, the records already built into your book (jobs, clients, contacts, costs, invoices and payments) stay; closing your account is what removes those.

Your accounting connection (QuickBooks). The confirmation reads: "Disconnect QuickBooks? Verinode stops reading your books, ends its access at Intuit, and deletes the copies it kept of what QuickBooks sent. The records already in your book, such as jobs, costs and invoices, stay; closing your account removes those too." That is exactly what happens: Verinode asks Intuit to revoke its access, deletes the stored sign-in, and deletes the raw copies it kept of what QuickBooks sent. The invoices, payments, jobs and costs already read stay in Margin and Cash Flow. If deleting the copies takes longer than the click, the message says so and the deletion finishes overnight.

A connected mailbox (Microsoft 365 or Gmail). The confirmation reads: "Disconnect this mailbox? Verinode stops reading it and deletes the mail it kept from it. Records already in your book stay." Verinode ends its access (for Gmail it also asks Google to revoke it; for Microsoft 365, deleting the sign-in it held is what ends it), then deletes the messages and attachments it kept from that mailbox, the documents it read out of that mail, anything from it still waiting in review, and the mailbox connection itself. Jobs, clients, contacts and costs already in your book stay. Mail you forwarded to your Verinode address is not part of the mailbox connection and is not touched. As with QuickBooks, if the deletion takes longer, it finishes overnight.

A connected calendar (Microsoft 365 Calendar or Google Calendar). The confirmation reads: "Disconnect this calendar? Verinode stops reading it, deletes the meetings it read from it, and cancels any Notetaker it booked from it that has not joined yet. Records already in your book stay." Verinode ends its access (for a Google calendar it also asks Google to revoke it; for a Microsoft 365 calendar, deleting the encrypted sign-in it held is what ends it), then cancels any Notetaker it booked from that calendar into a meeting that has not started, deletes the meeting times and titles it read, and deletes the calendar connection itself. A Notetaker already in a meeting stays to the end, and its notes are filed as usual. If you also invited your Verinode address to one of those meetings, its Notetaker is cancelled too; re-send the invite to your Verinode address to book it again. Notes the Notetaker already filed stay in your book. If the deletion takes longer than the click, the message says so and it finishes within the hour. Microsoft keeps showing Verinode in your account's app permissions until you remove it there, but Verinode no longer holds anything that can use it.

Job management and CRM tools connected with a key or a sign-in. Disconnecting removes the stored key or connection and stops the reading. Everything already read stays, including the copies Verinode kept of what the tool sent. Where the connection used a key you created in the tool, the confirmation tells you where to delete that key in the tool itself, because removing it from Verinode does not retire it there.

Shared folder. Each connected folder shows a Disconnect text control on its row, with a "Yes, disconnect" confirmation. Verinode stops reading the folder and the row disappears; documents already taken in stay in your account. Disconnecting in Verinode does not unshare the folder on the Google side: to close it off fully, also remove the Verinode service account from the folder's share settings in Google Drive.

Flow-assigned tools. Turn off on the tool's Flow card dismisses the assignment. It stops reminding whoever was pulling the data; it does not touch anything already uploaded, and you can set the Flow back up any time.

Verinode Notetaker. There is nothing to disconnect, since it is not a standing connection. It simply is not added to a meeting you do not invite it to.

Data contributors never see your numbers

Flow lets you hand a tool's recurring export to a teammate instead of doing it yourself. That teammate, called a data contributor, gets their own free Verinode login so their uploads are attributed to them specifically. Verinode is explicit about the boundary the moment you invite one:

"This emails [name] an invite to create a free Verinode login. Once they accept, they can upload the data you ask for and it's tracked to them. They never see your numbers, benchmarks, or decisions."

A data contributor's account can push data in. It cannot see your margin figures, your peer benchmarks, or the decisions Verinode surfaces to you. Delegating the busywork of an export never means delegating visibility into the business.

What happens if a source isn't available yet

Some connections are still rolling out. Gmail, for example, stays pilot-only because Google requires an annual third-party security review (CASA) of any app that reads Gmail; Microsoft 365 has no equivalent review and connects today. A tile that is not yet available reads Coming soon, and the wizard tells you the fallback in the meantime, usually forwarding an email or connecting a shared folder. None of these gaps are silent: every tile states plainly what to do until the direct connection ships.

Best-practice example

An operator wants their accounting system and their Outlook mail flowing in, but is cautious about a mailbox connection specifically because their inbox holds personal correspondence alongside carrier threads. They connect the accounting system first, a single OAuth popup, read-only, done in under a minute. For Outlook, they create a folder named "Verinode" and a rule that routes carrier, TPA, and vendor senders into it, then point the mailbox wizard at that exact folder name and check the consent box before connecting. From that point on, Verinode reads only the "Verinode" folder, never the rest of the inbox. A few months later, when they change accounting software, they disconnect the old accounting connection with one click; Verinode deletes the raw copies it kept of what that system sent, and the invoices and payments already read stay exactly where they are in Margin and Cash Flow.

Related reading

• The Integrations hub: the full tile-by-tile mechanics for every direct connection.
• Connecting a shared folder: the two-step handshake for the Google Drive folder connection.
• Setting up Flow for a tool: cadence, delegation, and reminders for tools with no direct connection.
• Your Vault Key: how invoice data is encrypted: the full mechanics of per-operator encryption at rest.
• Connect: get your data flowing: the Connect page as a whole.
• Forwarding documents: the fallback path for any source not yet connected directly.