Automation for US teams, built around QuickBooks, sales tax and security reviews
A US team automating operations meets four things early: QuickBooks as a widely used ledger, sales tax that varies by state and sometimes city, a CRM that is often HubSpot or Salesforce, and a security questionnaire that can arrive mid-deal.
US operations work is shaped by a different set of defaults. QuickBooks is a widely used ledger. Sales tax is a state matter, and sometimes a county or city matter, with no federal sales tax to lean on. HubSpot and Salesforce are both widely used CRMs. And somewhere in a sale to a mid-sized or enterprise buyer, a security questionnaire can turn up, sometimes with a request for a SOC 2 report.
This page covers those four and what they change in how we would build. It is not tax or legal advice, and it links to the IRS where there is a federal rule to point at; sales tax is a state-by-state matter, so your accountant and your state revenue department are the sources. It is also not a claim of US track record. None of the case studies on this site is a US engagement, and the evidence section says so.
The security section is the part a US buyer's reviewer is likely to look for first. It says plainly what Skofi does not have, and what we can give you in its place.
What is different about building here
Five things that change the design of a US finance or operations build.
QuickBooks as a common ledger
QuickBooks Online, from Intuit, is widely used by small US businesses. Its API uses OAuth 2 with a company identifier, and an update to an existing record has to carry that record's current sync token, or it is rejected as stale. That one detail decides how you design any flow that edits invoices or bills after creation.
Sales tax is a state matter
There is no federal sales tax. States set their own rules, and many have local rates on top, and what counts as taxable differs by state and by product. Since the Supreme Court's 2018 Wayfair decision, a state can require an out-of-state seller to collect its tax once the seller's activity there passes that state's threshold. That is why we would not hand-code rate tables: use a tax calculation service or your accountant's guidance, and build the plumbing around it.
Federal paperwork that automation can help with
Collecting a W-9 from contractors and vendors, and tracking what you pay them for 1099 reporting, is routine federal paperwork that suits an onboarding and approvals flow. Reporting thresholds and forms change, so the IRS is the source.
HubSpot and Salesforce
Some US buyers run HubSpot or Salesforce, or are choosing between them. We have a HubSpot platform page, though no published case study here is a HubSpot engagement. We have no published Salesforce engagement either; Salesforce integration work would be scoped against its REST and bulk interfaces, with the riskiest write proved first.
Privacy is a patchwork
There is no single federal privacy statute that covers everything. Several states have their own comprehensive laws, California's CCPA being the best known, each with its own thresholds, and some federal laws are specific to a sector, such as HIPAA for health information. If protected health information is in scope, say so at the start, because it changes which tools you can use at all. Take advice from a privacy lawyer on which laws apply to you.
When your buyer asks for SOC 2
SOC 2 is an attestation by an independent CPA firm about an organization's controls, either at a point in time (Type I) or across a period (Type II). It is not something a vendor can claim without the report.
What we do not have
Skofi does not hold a SOC 2 report or an ISO 27001 certificate. If an engagement requires a certification we do not hold, we are not the right fit, whatever the quality of the work. We would rather you learn that now than at the security review.
What we can show
How the systems we build are secured, in documents rather than adjectives. In the case studies that means permissions enforced in the database instead of the interface, an append-only audit log, and a build that fails if a privileged credential could reach the browser. Our approach is to build and deploy in your own accounts, so your data is not held in a tool of ours.
What the platforms underneath publish
The hosting, database and automation platforms an engagement runs on publish their own compliance documentation, usually in a trust center. Ask for the current report from each rather than relying on our summary. A SOC 2 held by a platform covers that platform, not the code we write on top of it.
How we handle a questionnaire
We answer reasonable security questionnaires truthfully, and say plainly when the answer is no. An NDA is optional and signed where the client requires one. The work runs in your own accounts, so access is yours to grant and revoke. A written architecture and access note with the handover is the aim, so the next review can be answered from a document.
Health information
No case study on this site is a HIPAA-regulated build. If protected health information is involved, tools that handle it on behalf of a covered entity generally need a business associate agreement in place, and it is worth checking early whether a given platform or plan offers one. Whether HIPAA applies to you, and what it requires, is a question for your privacy counsel. That conversation belongs at the start of a scoping call.
The US shape of each build
The deal-to-cash loop
A closed deal in HubSpot, or Salesforce, creates the customer and invoice in QuickBooks through a keyed write. Payment status flows back so sales sees whether the invoice has been paid without asking finance. It is a typical integration job, and the one where duplicates and stale updates do the damage.
Sales tax calculated by a service, reconciled by us
Tax is calculated at order time by a tax service, with the jurisdiction and amount stored on the order, and a reconciliation view compares what was charged against what the ledger recorded. We build the plumbing and the reconciliation. We do not write a rate table, and we do not file returns.
Vendor onboarding and AP intake
A vendor completes a W-9 through a form, the invoice is captured and read by a model, a person confirms it, and the approved bill lands in QuickBooks. The approval step gates the numbers, as it does in the trading ERP case study.
An evidence pack, if you want one
The aim is a written architecture note, who holds which credentials, what is logged and where, and how access is revoked, kept up as the work goes. It is what you would attach to the next questionnaire.
Where US accounting and CRM builds go wrong
- 01
Stale updates on QuickBooks records
Two people or two flows edit the same invoice, and the second update carries an out-of-date sync token. It is rejected, or, worse, a retry loop overwrites the first change. Updates re-read the record, merge, and write once, with the failure surfaced.
- 02
Duplicate customers and vendors
QuickBooks Online needs a display name to be unique across customers, vendors and employees. An integration that auto-creates a customer on every new deal collides with an existing vendor of the same name, or creates near-duplicates. We match on a stored identifier first and a name only as a fallback, and send ambiguous matches to a person.
- 03
Tax calculated twice
If QuickBooks calculates sales tax itself and an external tax service also does, the invoice total disagrees with the order total. We decide in the mapping call which system is authoritative and switch the other off.
- 04
Rotating tokens that nobody keeps
QuickBooks Online refresh tokens rotate, and Intuit advises storing the latest one every time. A flow that keeps using an old one eventually loses the connection, and nobody notices until a month of invoices has not posted. The newest token is stored every time, and a failed refresh raises an alert.
- 05
Hitting CRM API limits at the worst moment
HubSpot and Salesforce both limit API calls, by different rules. A bulk back-fill that runs during the working day starves the live flows. Back-fills are batched, scheduled off-peak and metered, and live flows keep priority.
Where we are the wrong answer
If your buyer's procurement mandates a SOC 2 Type II from every vendor, an independent builder without one is not an option, and you should say so early. If your problem is only sales tax across many states, buy a tax service rather than commissioning a build around it. And if you use QuickBooks Desktop rather than Online, the integration model is different (it uses a separate SDK and the Web Connector, not the Online API), so it is a separate scoping conversation, not an assumption.
What we can and cannot point to in the US
We have US engagements across fitness, training and education consulting, rental and property management, construction and real estate, including Make.com and Airtable work. Client engagements are anonymised by sector, so they are not named here. We do not claim a US entity, SOC 2 or ISO certification, or partner status with Intuit, HubSpot or Salesforce.
The two case studies below are the ones a security reviewer would find most relevant. They show how we secure a system, which is what a reviewer will want to see whatever the client's location.
Adjacent, not proof of presence
- A regional trading & distribution groupAn ERP with AI invoice capture and an audit trail that holdsNot a QuickBooks build. Relevant to a security review for its database-enforced permissions and an append-only audit log that even the application cannot rewrite.Case study
- A fleet-telematics providerOrders that file themselves, and an SLA clock that never forgetsRelevant for how the account-wide credential is confined to one process and the build fails if browser code tries to reach it.Case study
Check the rules with the people who own them
Sales tax collection, 1099 reporting and state privacy law depend on your states, your products and your size. Your CPA and your state revenue department are the authorities on the first two; the IRS covers the federal paperwork. We build to the rules you give us and will tell you where we think a question needs an expert.
The disciplines behind it
Related reading
Other markets
United States, specifically
No. Skofi does not hold a SOC 2 report or an ISO 27001 certificate. If your policy requires one from every vendor, we are not the right fit. If it does not, we can offer a written architecture and access description, work in your own accounts, answer reasonable security questionnaires truthfully, and point you to the compliance documentation of the platforms underneath.
We answer reasonable ones truthfully, and say plainly when the answer is no. Some answers will be no or not applicable, and we would rather say that than give an answer we cannot back with evidence. An NDA is optional and signed where you require one.
QuickBooks Online has a public API and is what we would scope against, with a test company first. QuickBooks Desktop works on a different integration model, a separate SDK and the Web Connector, so it is a separate scoping conversation. We have no published QuickBooks case study.
No. We build the flow that calculates tax through a service, stores the result on the order and reconciles it against the ledger. Rates, registration and filing belong to your accountant or a tax service.
Most of our projects land between $5,000 and $10,000 (US dollars). Larger systems cost more than $10,000. That is a typical range, not a quote: we quote after a discovery conversation, once we have seen the process, its exceptions and the systems involved. Our cost article sets out what moves the number, which is the count of exceptions, the systems that believe they own the same data, and whether rules need a database.
We work from Pakistan, on Pakistan Standard Time (UTC+5), which has no daylight saving. That makes Pakistan 10 hours ahead of US Eastern while the East is on standard time and 9 hours ahead on daylight time, and 13 hours ahead of US Pacific on standard time and 12 on daylight time. Working hours are arranged to overlap with both US Eastern and US Pacific business hours.
By Wise, PayPal or Payoneer, agreed at the start of an engagement.
Sources
Statements about what a platform, regulator or provider says come from their own pages. Rules and limits change, so check the current page before you rely on one.
- System and Organization Controls: SOC Suite of Services · AICPA & CIMA
- Small Business and Self-Employed Tax Center · IRS
- South Dakota v. Wayfair, Inc. (17-494), opinion of 21 June 2018 · Supreme Court of the United States
- Business Associate Contracts · U.S. Department of Health and Human Services
- 5010 - Stale Object Error · Intuit Developer
- Handling OAuth token expiration with the QuickBooks Online API · Intuit Developer
Page copy drafted with AI assistance. Skofi is accountable for it. Editorial policy
Tell us about the process that keeps costing you.
A 15-minute call is usually enough to say whether this is an automation, an integration, or something that should be built, and whether we are the right people for it.
What happens on the call
- 15 minutes, no deck
- We map the process on the call
- A written scope, or an honest no