Linking project management software to accounting is one of the most useful things a contractor can do. Commitments, change orders, and pay applications flow to job cost without retyping, and project managers see current financial data. But every integration is also a privileged connection between systems that hold sensitive information, and it deserves the same care as any user account.
This post covers practical safeguards whether you use Procore, Sage, Viewpoint, or other platforms.
Why integrations deserve attention
An integration usually authenticates with credentials or tokens that have broad permissions, often more than any human user needs. It runs continuously, often without anyone watching. If the credentials leak, an attacker can read or alter financial data without ever logging in as a person. If the integration misbehaves, it can duplicate or overwrite records at scale.
Integrations also accumulate quietly. A pilot project, a departed consultant's script, or a trial of a new tool can leave connections active for years.
Step 1: Inventory every connection
List all integrations among your systems:
- Direct connectors between project management and accounting platforms.
- Third-party middleware or sync tools.
- Custom scripts and scheduled imports or exports.
- Spreadsheets with data connections.
- Reporting and analytics tools pulling from accounting databases.
For each, record what it connects, what data moves, who owns it, who set it up, and what credentials it uses.
Step 2: Use dedicated service accounts
Integrations should not run under an employee's personal login. When that employee leaves and their account is disabled, the integration breaks, or worse, someone keeps the account alive to avoid disruption. Create dedicated accounts for each integration, name them clearly, and document their purpose and owner.
Step 3: Apply least privilege
Grant the integration only the permissions it needs. If it only pushes approved commitments to accounting, it should not be able to delete vendors or change bank details. Review the permissions offered by each platform's integration settings and choose the narrowest option that makes the workflow function.
Step 4: Protect credentials and tokens
- Store secrets in a managed vault or the platform's secure settings, not in spreadsheets, emails, or scripts.
- Use unique credentials for each integration.
- Rotate credentials on a schedule and whenever someone with knowledge of them leaves.
- Prefer token-based authorization with expiry and revocation over shared passwords where available.
Step 5: Separate duties
Integrations can undermine financial controls if they let a single actor create and approve. Make sure approval workflows are preserved across systems. For instance, a vendor created in a project system should still go through your standard verification before it can be paid, and banking details should not sync from a field system without review.
Step 6: Log and monitor
Enable logging for integration activity and review it periodically. Useful questions include:
- Did the integration run when expected?
- Were there failures, retries, or unusual volumes?
- Were any records changed that should not have been?
- Did the integration authenticate from unfamiliar locations?
Set alerts for failures. A silent failure can leave financial data stale and nobody aware.
Step 7: Test changes before production
Whenever you change an integration, update either system, or alter workflows, test in a sandbox or with a limited dataset first. Keep backups of both systems before major changes so you can roll back if records are damaged.
Step 8: Review regularly
Twice a year, go through the inventory. Retire anything unused. Confirm owners are still employed and still responsible. Check that permissions still match current needs.
Special concerns
Vendor banking details
Payment diversion often targets vendor banking changes. Make sure that any integration touching vendor payment details follows the same verification rules as manual changes, and that alerts fire when those fields change.
Third-party apps
Marketplace apps and add-ins are convenient, but each one is another company with access to your data. Evaluate the vendor, ask where data is stored, and remove apps that are no longer used.
Document the integration map
A simple diagram showing systems and data flows is valuable for troubleshooting, audits, and insurer or customer questionnaires. Keep it current.
Support from Ironfield Cyber
Ironfield Cyber reviews integrations and permissions across construction and accounting platforms, and helps establish service accounts, credential handling, and monitoring. If you are unsure what is connected to your accounting system, we can help map it.