Cash flow forecasting software can be connected to your accounting system with confidence once IT has checked a short list and verified the answers: what the connection can read and whether it can write, how it is authorised and revoked, how people sign in, who can see what, who at the vendor can get in, where the data is held, what independent assurance exists, and what happens to the data when you leave. Each check has a question, a reason, and a way to verify the answer. None of them needs a questionnaire built for a core banking system.

In short, a forecasting tool reads the ledger, so it deserves a real security check, not a wave-through because it sits on an app marketplace. But the check should be sized to what the tool does with the data. The UK's National Cyber Security Centre tells buyers to set supplier requirements that are "justified, proportionate and achievable", and not to make every supplier meet the same list. Ten questions, each with evidence, is that standard applied to a read-only finance tool.

Why IT Is Asked Late, And Why The Answer Matters

Finance usually chooses a forecasting tool, runs a trial, and then asks IT to approve the connection to the accounting system. By then the tool has already been reading customer names, supplier names, invoice amounts and reconciled bank balances in a trial account. The approval decides whether that becomes permanent, and IT is often one person or an outsourced provider with little time to decide.

Two things tend to happen. The first is approval on trust, because the tool is listed on the accounting platform's marketplace, without anyone establishing what the connection can do, who can sign in, or where the data goes. The second is the full enterprise security questionnaire, built for systems that move money or hold payroll, sent to a vendor whose product reads a ledger once a day. One leaves a gap; the other stalls a purchase the finance team has already justified. If the business case is still open, our guide to the business case for cash flow forecasting software makes it.

Supplier review is still unusual at this size. The UK government's Cyber security breaches survey 2025/2026 (published 30 April 2026) found that 15% of businesses had formally reviewed the risks posed by their immediate suppliers and 6% their wider supply chain. The figure rises with size: 22% of small businesses (10 to 49 staff), 30% of medium businesses (50 to 249) and 48% of large businesses. A finance team of three to eight sits at the boundary of the first two bands. No equivalent official measure exists for Australia, New Zealand or the United States.

The Ten Checks For Any Finance Tool That Connects To The Ledger

The ten checks below cover access, authentication, people, location, assurance, contract and exit. Each has three parts: the question to put to the vendor, why it matters, and how to verify the answer rather than take it. They apply to any SaaS tool that reads the accounting system, not only a forecasting tool.

1. What The Connection Can Read, And Whether It Can Write Back To The Ledger

Ask: Which permissions does the tool request from the accounting platform, and can it create, change or delete anything in the ledger?

Why it matters: A tool that can only read cannot corrupt the books; a tool that can write needs the same scrutiny as a member of staff with posting rights. Read access still means the vendor holds a copy of commercially sensitive data, so the rest of the list applies either way.

How to verify: Both platforms grant access through OAuth 2.0, and the permissions requested appear on the consent screen at connection time. Xero publishes read-only scopes for invoices, bank transactions, payments and contacts alongside the read-and-write versions, and tells developers to request the minimum scopes required. Ask the vendor to show you its consent screen before you approve it, and ask whether its sync is one-way.

2. How The Connection Is Authorised, And How To Revoke It

Ask: Does the tool connect through the platform's own authorisation, without your accounting password, and can an administrator disconnect it from inside the accounting system?

Why it matters: The OAuth 2.0 standard (RFC 6749) is built so that "the resource owner's credentials are never shared with the client". The tool receives a token, not your password, and the platform can revoke it. A tool that asks for your Xero or QuickBooks login has failed this check before it starts.

How to verify: In QuickBooks Online, only Admin users can connect and manage apps, and an app is disconnected from the Integrations area. Xero lists connected apps under the organisation's settings. Confirm that someone on your side holds that role and record who authorised the connection and when. The NCSC's guidance on using SaaS securely says to review each integration's permissions, who authorised it and when it was last used, and to remove access no longer needed. Our guide to setting up automated cash flow forecasting with Xero walks through the connection steps.

3. How Users Sign In: Multi-Factor Authentication

Ask: Is multi-factor authentication available, is it enforced for every user rather than offered, and which methods does the tool support?

Why it matters: Every national cyber security agency in the four markets puts MFA at the top of its list for business systems. The NCSC says all users and administrators should be required to use MFA when accessing sensitive data in an online service. A ledger copy is sensitive data.

How to verify: Ask for the setting, not a statement: "MFA available" and "MFA enforced" are different answers. Then ask which methods are supported. The NCSC ranks phishing-resistant methods such as FIDO2 security keys and passkeys first, authenticator-app codes third, and codes sent by text message last. Authenticator-app codes are accepted everywhere; they are not the strongest method.

4. Who Can See What: Roles And Least Privilege

Ask: What user roles exist, is there a read-only role, and who can add or remove users?

Why it matters: NIST's Cybersecurity Framework 2.0 asks organisations to manage access on "the principles of least privilege and separation of duties". A director who needs to read the forecast should not be able to change it, and a departing employee should lose access the day they leave, without a support ticket.

How to verify: Ask for the roles list and test it in the trial: create a read-only user and confirm they cannot edit. Confirm that your own administrators, not the vendor, add and remove users. Our guide to cash flow visibility tools for finance team collaboration shows how the roles are used day to day.

5. Who At The Vendor Can Access Your Data, And Who Switches That On

Ask: Can the vendor's staff open your account, under what conditions, and does the customer control it?

Why it matters: Support staff sometimes need to see what a customer sees. The question is whether that access is standing or switched on by the customer for a purpose, and whether it is logged. The NCSC's cloud security principles say you should "know where your data is, and who can access your data"; the second half of that sentence is this check.

How to verify: Ask whether support access is customer-controlled and how it is turned off. Ask whether any engineering access to production data exists outside that control, and whether it is logged.

6. Where The Data Is Hosted, And Under Which Law

Ask: In which country is the data stored, where are backups and support staff located, which subprocessors are involved, and which legal entity is the contract with?

Why it matters: The country sets the law that applies to the data and the privacy regime that governs any personal data inside it. A ledger contains personal data: customer and supplier contacts at the least. Location also determines which transfer rules apply when the vendor is overseas.

How to verify: Ask for the hosting region, the subprocessor list and the contracting entity in writing. In the UK, a vendor outside the country needs a lawful transfer route, such as adequacy or the International Data Transfer Agreement; the regulator since 30 September 2026 is the Information Commission (formerly the ICO). In Australia, APP 8 asks a business to take reasonable steps before disclosing personal information overseas, and it remains accountable for the recipient. In New Zealand, a provider that only stores or processes information on your behalf is treated as you holding it, and you remain responsible for it.

7. Independent Assurance: What ISO 27001, SOC 2 And Cyber Essentials Each Tell You

Ask: Which independent certifications or reports does the vendor hold, over what scope, and can you check them?

Why it matters: The three names most vendors cite test different things, none certifies a product, and none is required by law for a tool of this kind in any of the four markets. The official bodies publish no ranking of the three.

How to verify:

• ISO/IEC 27001 certifies an information security management system against a stated scope. ISO itself says "ISO does not perform certification or issue certificates"; a certification body does. Check that the certificate is to the 2022 edition (2013 certificates expired at the end of October 2025), read the scope to confirm it covers the service you are buying, and verify it through IAF CertSearch or the certification body.

• SOC 2 is an attestation report issued by a licensed CPA firm under AICPA criteria, not a certificate, and there is no public register. The AICPA's guide says a report is "restricted to use by users with that knowledge", so you read it rather than look it up. Check the type (Type 1 is a point in time; Type 2 covers a period and includes the auditor's tests), the period, the categories, the opinion, any exceptions, the controls the report expects you to run, and whether the cloud host is carved out. If the period ended months ago, ask for a bridge letter.

• Cyber Essentials is the UK government-backed scheme, delivered by IASME, covering five technical controls on the vendor's own IT: firewalls, secure configuration, security update management, user access control and malware protection. Certificates last 12 months and are searchable on IASME's register. The current requirements put cloud services in scope, but also say "Bespoke and custom components of web applications are out of scope." The certificate tells you about the vendor's estate, not its product code.

8. Personal Data And The Processor Contract

Ask: Does the vendor offer a data processing agreement, and does it cover what the law in your market requires?

Why it matters: The vendor processes personal data on your behalf, which in the UK means a written contract with the terms set out in UK GDPR Article 28(3): the subject matter and duration of the processing, its nature and purpose, the types of data and people concerned, and your rights and obligations. Australia and New Zealand set their expectations through APP 8 and the Privacy Act 2020 rather than a fixed clause list. The United States has no general federal rule for an ordinary business; the FTC's Safeguards Rule applies to businesses that are themselves financial institutions.

How to verify: Ask for the agreement and read the clause on the end of the contract. The Information Commission's guidance says the processor must, "at the controller's choice, delete or return" the data. This page does not give legal advice; check the regulators' pages with your own adviser.

9. Leaving: Export, Deletion And How Long Data Is Kept

Ask: How do you get your data out, when is it deleted after you cancel, and does deletion include backups?

Why it matters: Disconnecting the tool from the accounting system does not delete what the tool already holds. Intuit's own help says so: "Your data may be separately maintained by apps after transferring or disconnecting." Revoking access and deleting data are two actions, and the second needs a stated period. No regulator in the four markets prescribes a retention period after termination; the vendor's documented period is what you are agreeing to.

How to verify: Ask for the export formats, the deletion period in writing, and whether backups follow the same schedule. Australia's APP 11 expects personal information to be destroyed or de-identified when no longer needed, including copies held by service providers.

10. Who To Call: Support And Incident Contact

Ask: Who do you contact about a security question, and how and when would the vendor tell you about an incident affecting your data?

Why it matters: New Zealand's NCSC asks buyers whether suppliers are contractually obliged to report incidents and whether that reporting arrives in time to act. Breach-notification clocks in each market run from when you know, so a vendor that tells you late shortens your own time to respond.

How to verify: Ask for a named security contact and the incident notification commitment in the contract, not a general support address.

How Big Should The Check Be?

The check should be sized to the data and the access, not to the size of the vendor or the price of the tool. A read-only forecasting tool that holds a daily copy of the ledger warrants a real review, because the ledger is commercially sensitive. It does not warrant the review you would give a payments system or the accounting platform itself.

Two NCSC positions frame this. Its supply-chain principles tell buyers to set proportionate minimum requirements and not to force every supplier through the same list. Its separate "lightweight" cloud assessment is reserved for services that hold no sensitive data, so it is not the route for a tool that reads your ledger. The ten checks sit between the two. Read-only access removes the risk of the tool changing your books; it does not remove the confidentiality risk of a copy sitting with a third party, which is why checks 5 to 9 apply as fully to a read-only tool as to any other.

How Float Answers Each Check Today

Float is cash flow forecasting software for in-house finance teams. It connects to Xero and QuickBooks Online today, with Sage Intacct coming soon (you can join the Sage Intacct waitlist). The table gives Float's answer to each check from its help centre, with the article behind it. Where the help centre does not cover a check, the row says so.

Where a row says "ask Float", bring the question to the conversation below, and put the answer in your file.

Frequently Asked Questions

Is cash flow forecasting software secure enough to connect to our accounting system, and what should IT check?

It can be, and the way to know is to check rather than assume. IT should establish what the connection can read and whether it can write, how it is authorised and revoked, whether MFA is enforced, what roles exist, who at the vendor can get in, where data is hosted, what independent assurance covers the service, and how data is deleted when you leave.

What is a SaaS security checklist, and how long should it be?

A SaaS security checklist is the set of questions a buyer puts to a software vendor before connecting it to business systems, with a way to verify each answer. No official body sets a length. The NCSC's guidance asks for requirements that are proportionate to the risk, which for a read-only finance tool means around ten evidenced questions rather than an enterprise questionnaire.

What is the difference between SOC 2 and ISO 27001?

ISO/IEC 27001 is a certification, issued by a certification body against a stated scope, that an organisation runs an information security management system. SOC 2 is an attestation report, issued by a CPA firm under AICPA criteria, describing a system and testing its controls over a period. Neither certifies a product, no official body ranks them, and both need their scope read.

What should a finance director look for in cash flow forecasting software for a business with a finance team of four?

Start from the team's own requirements: the forecast horizon, the data sources, the entity and bank-account structure, and who needs to see what, then score tools against them. Security is one item on that list. The full requirements checklist is in what should a finance team require from cash flow forecasting software.

Which cash forecasting tools let a finance manager, finance director and CEO work from the same forecast with different permissions?

Any tool with role-based access can do this, so the question is which roles exist. Look for a read-only role for the CEO or board, an editing role for the finance manager, and an administrator role that controls users and integrations. Check 4 above explains how to test it in a trial. Float offers Owner, Admin, Editor and Viewer roles.

How do we run a vendor security assessment without a security team?

Use the ten checks on this page, ask the vendor for evidence against each one, and verify the three that are checkable from outside: the consent screen at connection, the certificate register, and the roles in a trial account. Record the answers, the date and who approved the connection, and put the connected-apps list on a quarterly review.

Bring Your IT Questions

Float is built for in-house finance teams of three or more, and the IT manager is part of that buying committee. If IT has questions this page does not answer, bring them to a conversation with the Float team. The rows marked "ask Float" above are the ones to start with.