GaussBook Privacy & Zero-Knowledge Data Blinding Policy
Supply-chain vendor lists and customer pricing are among a company’s most sensitive trade secrets. GaussBook is engineered so that you never expose your full general ledger, payroll, or non-adjacent supply-chain relationships to competitors or third parties.
Non-trade operating expenses (PRIVATE_PAYROLL, PRIVATE_LEGAL, PRIVATE_RENT) are stripped locally in your browser before any packet leaves your device.
9-digit Employer Identification Numbers (EINs) are blinded with a 256-bit high-entropy salt to defeat rainbow-table dictionary attacks across the ~900M EIN keyspace.
Each participant receives a local 2-Edge SHA-256 Merkle Boundary Proof proving its own direct customer and direct vendor without revealing upstream/downstream hops.
Disconnect QuickBooks Online, Xero, NetSuite, or Stripe at any time with immediate cryptographic revocation and token purge.
Data Controller vs. Data Processor Relationship
Each participating business remains the sole Data Controller of its accounting general ledger, Accounts Payable, and Accounts Receivable records. GaussBook acts strictly as a limited-purpose Data Processor (and service provider under the California Consumer Privacy Act [CCPA] and GDPR Article 28) authorized solely to discover closed circular B2B trade loops, verify U.S. GAAP ASC 405-20-40-1 invariants in Microsoft Z3, and post authorized double-entry novation writebacks.
Client-Side Browser Scrubbing of Non-B2B Operating Expenses
When a Participant uses the Client-Side AP/AR CSV Aging Uploader or OAuth 2.0 sync, non-intersecting operating expenses—including employee payroll (PRIVATE_PAYROLL), outside legal counsel (PRIVATE_LEGAL), tax authorities (PRIVATE_TAX), and commercial rent (PRIVATE_RENT)—are filtered and discarded inside the client browser memory prior to upload. Those rows are never transmitted to GaussBook servers.
RFC 9497 Oblivious Pseudo-Random Function (OPRF) & Circuit-PSI
Because U.S. Employer Identification Numbers (EINs) occupy a compact 9-digit keyspace (XX-XXXXXXX) that is vulnerable to unsalted SHA-256 dictionary enumeration, GaussBook blinds every Tax ID via an RFC 9497 Oblivious Pseudo-Random Function (OPRF) with a 256-bit high-entropy key (oprf_k(EIN)). Bilateral payable edges are aligned using Circuit-PSI handshake tokens (psi_edge(EIN_debtor, EIN_creditor, invoice_id)) so only mutually acknowledged B2B trade edges enter the Tarjan SCC solver.
Zero Non-Adjacent Supply-Chain Disclosure (2-Edge Merkle Proofs)
In a k-hop clearing loop (k ≥ 3), Participant i never receives the corporate identity, invoice IDs, or pricing margins of non-adjacent participants (i+2, i+3, …). Instead, GaussBook constructs a SHA-256 Merkle tree over the cycle edges and issues Participant i a Local 2-Edge Merkle Boundary Inclusion Proof containing only its own incoming receivable edge e_in, its own outgoing payable edge e_out, and the sibling SHA-256 hashes required to verify the signed Cycle Merkle Root.
Zero Data Brokerage, Zero Ad Tracking & Audit Retention
- Zero Sale or Sharing of Financial Data: GaussBook never sells, rents, brokers, or shares customer ERP data or supplier graphs with third-party advertisers, credit bureaus, or lenders.
- Zero AI Model Training on Customer Ledgers: All cycle detection and formal verification run deterministically via Tarjan’s SCC algorithm, 64-bit integer min-cost circulation, and Microsoft Z3 SMT-LIB2—never stochastic third-party LLM training pipelines.
- 7-Year CPA Audit Certificate Retention: While OAuth 2.0 tokens and ephemeral staging buffers can be purged immediately upon request, Ed25519-signed ASC 405-20-40-1 certificates and Merkle roots are retained so Participants can substantiate extinguished liabilities during IRS or external CPA financial statement audits.
1-Click ERP OAuth 2.0 Token Disconnect & Data Purge
In compliance with the Intuit QuickBooks App Partner Program and Xero App Store security lifecycle requirements, you can revoke OAuth 2.0 access and purge cached session tokens for any connected ERP provider below: