Data Sources for eDiscovery Professionals
Quickbooks
Company Snapshot
Intuit Inc. (NASDAQ: INTU) operates the QuickBooks Online (“QBO”) cloud‑accounting ecosystem used by more than 6.5 million paying subscribers worldwide (FY 2023) and generated $2.1 billion in Online Ecosystem revenue in Q3 FY 2025 alone.
Origin
QuickBooks desktop software appeared in 1998, but the first web‑native QuickBooks Online edition launched in 2001 as Intuit’s answer to the browser‑based SaaS wave.
The Quickbooks Platform
QuickBooks Online is a multi‑tenant, metadata‑driven ledger running on Intuit’s GenOS platform. Key traits that matter to eDiscovery teams:
- Immutable audit log – Every create/update/delete is recorded in the Audit Log UI and exposed via the Change Data Capture (CDC) API.
- REST API v3 – 700+ endpoints secured with OAuth 2.0; supports sparse updates, CDC, and webhooks for near‑real‑time collection.
- Attachable object store – Binary files (PDFs, images, emails) linked to transactions can be uploaded or downloaded via the Attachments API.
- Multi‑currency & tax engines – Embedded sales‑tax, payroll‑tax, and currency tables provide rich forensic context.
Extracting Quickbooks Data for Investigation
| Method | What you get | Typical Volume | Pro Tips |
| Settings ▶ Export Data UI | ZIP of CSV/Excel reports & lists (GL, customers, vendors, attachments) | Up to entire company | Capture at matter open; QBO timestamps export in UTC. |
| Reports API / Accounting API (/v3/company/<realmId>/query) | JSON or CSV via SOQL‑like query syntax | Low → High | Filter by MetaData.LastUpdatedTime for incremental pulls. |
| Change Data Capture API (/cdc) | Full payloads for entities changed since a cursor | Continuous | 30‑day look‑back; paginate ≤1,000 objects per call. |
| Webhooks v3 | Push events for create/update/delete | Low | Use to trigger targeted collections during legal holds. |
| Attachments API (/upload, /download) | Binary evidence (receipts, contracts) with metadata | Low–Medium | Hash SHA‑256 on ingest; include AttachableRef links. |
Preservation note: By default QBO retains audit‑log entries for the life of the subscription, but attachments and deleted transactions purge after 365 days if automated clean‑up is enabled. Place the company under an Intuit Data Services backup or export attachments immediately.
Common eDiscovery & Investigation Use Cases
- Embezzlement & fraud – Reconcile GL, bank‑feeds, and attachments (e.g., falsified receipts).
- Payroll & wage claims – Extract QuickBooks Payroll journals and time‑tracking (TSheets/QuickBooks Time) data.
- Contract disputes & revenue recognition – Analyze invoices, sales receipts, deferred‑revenue schedules, and associated emails.
- Tax audits & regulatory probes – Produce books, audit trail, and sales‑tax detail for IRS or state inquiries.
- Data‑breach response – Locate PII in customer/vendor records and attached documents.
Related Technologies in the Quickbooks Portfolio
- TurboTax – Consumer tax filing
- Credit Karma – Personal‑finance & credit monitoring
- Mailchimp – Marketing automation / email
- QuickBooks Time (TSheets) –Time‑tracking & scheduling
- QuickBooks Payroll / Payments / Capital – Payroll processing, merchant payments, working‑capital loans
- Mint (sunset 2024, transitioned to Credit Karma Money) – Personal budgeting
- Intuit Assist (Gen AI) – Gen‑AI assistant across QuickBooks & Mailchimp