Accounting & Tax AI
Botkeeper
Medium riskAI-plus-human bookkeeping automation for accounting firms, connecting to client general ledgers and bank feeds to automate transaction categorization and close work.
Is Botkeeper safe for confidential data?
Botkeeper's baseline controls check out — SOC 2 Type 2 accreditation renewed annually, 256-bit encryption for data at rest and in transit, two-factor authentication, and US-based AWS hosting — but the model concentrates unusually deep access: full client ledgers and live bank feeds flow through the platform, and the AI-plus-human design means people outside your firm can see client financial data as part of normal service delivery. The company has also been through corporate churn: in March 2026, Xendoo acquired Botkeeper's AI bookkeeping platform, Infinite, which makes questions of data ownership, contract continuity, and who your processor actually is worth re-confirming rather than assuming from older agreements. Botkeeper does not publish an AI training policy for customer data, so put a no-training clause in writing.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
Sold as a managed service to firms rather than as self-serve software; the AI training question is not answered publicly, so it belongs in the contract.
Data handling
Training on inputs
Botkeeper does not publish whether customer ledger data is used to train or improve its AI models — treat as unknown and resolve it contractually. The human-in-the-loop model additionally means service personnel access client books as part of delivery.
Retention
Not published in specific terms; Botkeeper states it does not sell, rent, or lease personal information, but retention and deletion timelines for client financial data should be fixed in the service agreement.
Residency
Hosted in AWS data centers within the United States; no Canadian or EU residency option is published.
Compliance
- SOC 2Yes
- GDPR / DPANot verified
- HIPAA BAANot verified
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- SOC 2 Type 2 accreditation, renewed annually
- 256-bit encryption at rest and in transit
- Two-factor authentication
- US-based AWS hosting
Frequently asked questions
Is Botkeeper safe for client books?
Its audited security baseline is solid — SOC 2 Type 2, strong encryption, 2FA — and thousands of firm engagements run on it. The risks to manage are scope and people: the platform holds live bank feeds and complete ledgers, and the hybrid model means non-firm personnel touch client data, which your engagement letters and client consents should reflect.
What does the Xendoo acquisition mean for our data?
In March 2026, Xendoo acquired Botkeeper's Infinite platform. Acquisitions of this kind transfer customer data and contracts to a new operator, so firms should confirm which entity now processes their clients' books, whether existing security and confidentiality terms survived assignment, and what the exit and data-return path looks like. None of this implies a problem — it implies re-verification.
Does outsourcing bookkeeping to an AI service outsource the risk?
No — confidentiality obligations under AICPA rules follow the data, not the vendor, and disclosure to a third-party processor typically requires client consent or contractual safeguards you can point to. There is also a second exposure the service does not cover: staff handling the exceptions the automation kicks back often paste client details into free chatbots to resolve them, outside any agreement.
Policy changelog
- Initial entry published from Botkeeper's published security documentation and cited acquisition coverage.
Sources
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
Botkeeper is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
Generative AI tax research platform for tax practitioners, answering US and Canadian tax questions with citations to primary authorities.
Excel-embedded intelligent automation platform for audit and finance teams that extracts and cross-references evidence from client documents inside the workpaper.
AI-native audit and advisory platform for CPA firms where AI Field Agents perform engagement work such as controls testing and evidence review under practitioner supervision.
Generative AI assistant embedded in QuickBooks Online that drafts invoice reminders, categorizes transactions, and surfaces financial insights for businesses and their accountants.