Security

QBO security answers three questions on every request:

• Who are you? Users sign in with a password, through single sign-on with an identity provider, or (for systems) with an API key.
• What may you do? Roles grant functional permissions, such as searching processes, saving a contact, or deleting a message. Permissions also control which pages and panels a user sees.
• Which records may you see? Extranet (row-level) security limits partners and vendors to the records they work on. A law firm sees only the processes assigned to it; an adjuster sees only their claims.

Row-level security is maintained as records are saved, not computed when they are read. As processes are assigned and reassigned, access follows automatically, and searches stay fast.

Every sign-in attempt, API key use, lockout, and impersonation is written to the security log.

Key concepts

Concept	In QBO	What it does
User	Person	A user account: user name (typically an email address), active flag, lockout date, last login.
Role	SystemRole	A group of permissions. A role marked Universal Access bypasses row-level security.
Permission	SystemFunction / SystemPermission	A named function (for example ContactSearch) and the roles granted it.
Group access	ObjectAccess	Grants a group (an organization, role, or user) select, insert, update, or delete access to a record.
Membership	PersonAccess	Places a user in a group, such as a partner organization.
Extranet setting	Extranet on a template	Decides how a template’s records take part in row-level security: None, Self, Family, or Template.
API key	SecurityAccess	A key bound to a user account, sent in the X-ApiKey header, with optional expiry, login limits, and IP restrictions.
Security log	SecurityLog	Audit trail of sign-ins, failures (with reasons), lockouts, and impersonation.

Policy and compliance documents (SOC 2 and related policies) are published on the Quandis Trust Center.

Choose your view

Use the buttons under the page title. End user covers signing in and why you see the records you see; Power user covers users, roles, group access, extranet settings, single sign-on, and API keys; Developer covers the security data model, how row-level filters are applied to statements, and authenticating API calls. For how security fits the rest of the platform, see Security.