Security & Trust
It can read your money. It can’t touch it.
Quaestor has read access to your balances and transactions and no path to move money, make a payment, or change anything at your bank. That is not a setting you have to find. The capability does not exist. Everything below is the short version, and every line of it is also true in the long version, the Privacy Policy.
Encrypted in transit and at rest
Ledger, receipt and account data is encrypted on the wire and on disk, behind access controls and monitoring.
Read-only bank connections
Bank links are created through Plaid. Quaestor never receives your bank login and cannot initiate a payment, a transfer, or any movement of money.
AI scoped to one session
The assistant answers through read-only tools scoped to the signed-in user and organization for that request, and to nothing else.
What read-only means
Quaestor connects to your accounts through Plaid. You sign in with your bank inside Plaid’s hosted flow; Quaestor never sees the password and receives access scoped to the financial data the ledger needs: accounts, transactions, balances and liabilities. It cannot move money, initiate a transfer, make a payment, or change your external bank accounts.
For institutions outside Plaid’s coverage, or accounts you would rather keep out of the sync, import a CSV or QIF file and the ledger treats it the same way.
How the AI is walled off
The assistant is a read-only reader of your own ledger. Each chat request is scoped to the signed-in user and organization for that session, and the assistant can only answer through approved read-only data paths. It can tell you what your money did. It cannot do anything to it.
Your ledger, receipts, OCR text, categories, accounts and transactions are private customer data. The assistant treats all of it as data rather than instructions, so a merchant name is only ever a merchant name. Quaestor Ledger does not use that data to train AI or intelligence systems, and AI services are configured to restrict training use of customer content where available.
Two things that could move money, and where they go
Setup asks you for two things that could move money if they leaked: a bank login and a payment card. Neither one is ours to hold. The bank connection is created in Plaid’s hosted flow, so your bank password never reaches Quaestor. What Quaestor keeps for that link is an encrypted, read-only access token, good for account, transaction, balance and liability information and for nothing else. The card is collected and stored by Stripe for your subscription and is used for nothing but the plan you chose; Quaestor keeps a billing reference, never the card number.
What Quaestor does hold, your ledger, receipts, account details and the questions you ask the assistant, is covered by the controls below and spelled out in the Privacy Policy.
Security controls
- Bank login credentials stay with your institution and Plaid. Quaestor Ledger never holds them.
- Connected-bank access is data-only: account, transaction, balance and liability information, nothing that can move money.
- Every financial record is isolated by the authenticated account and organization it belongs to.
- AI chat uses read-only paths and treats ledger, receipt and OCR text as data, never as instructions.
- Quaestor Ledger does not use your personal financial data to train AI or intelligence systems.
- AI services are configured to restrict training use of customer content where available.
Need more detail?
For the full legal description of data collection, retention, subprocessors and AI data handling, read the Privacy Policy. Security questions go to support@quaestorledger.com, and a person answers them.
Read-only from the first minute.
7 days free, then $12.99 a month or $89.99 a year. Card required, cancel anytime before your first payment.
Free trial for first-time customers; if your organization has subscribed before, the paid plan starts at checkout. Renews automatically until you cancel in Settings. Taxes may apply.