Your documents are yours.
What we do today to protect the documents and data you send us.
Encrypted in transit
The website, app, API and webhooks are served only over HTTPS.
Hosted in the United States
Your documents and data are stored and processed in the United States. Documents are read by Anthropic's Claude API; nothing else leaves our infrastructure except what you send yourself, such as an export or an approved email to a supplier.
Your data stays in your account
Every request is scoped to your company, and team roles decide who can upload, approve, export and manage settings.
Credentials kept locked
Accounting connection tokens, webhook signing secrets and two-factor secrets are encrypted in our database with a key held outside it. API keys are stored only as hashes and shown to you once, so a lost key is replaced rather than recovered, by you, in the app.
Originals deleted on your schedule
You choose how long we keep the original scan or PDF: 30, 90 or 365 days, or indefinitely. Ninety days is the default. A job runs nightly and deletes them for real; your extracted data is kept until you delete it.
Two-factor login
Anyone on your team can turn on a code from their phone, and a company owner can require it for everyone. Our own staff accounts have required it since the admin tools were built.
Never used to train models
Documents are processed with Anthropic's Claude through its commercial API, which doesn't use API data to train models by default. We don't train models on your documents either.
People approve what leaves
Nothing is emailed to a supplier or vendor until someone on your team approves it, and QuickBooks and Xero sync only runs on approved documents.
An audit trail
Sign-ins, uploads, approvals, exports, deletions, setting changes, supplier-link accesses and any access change made by our staff are recorded in your account's audit log. On the Team plan you can download the whole thing.
Signed webhooks
Every webhook is signed with your endpoint's secret, and we only deliver to public HTTPS addresses.
Payments through Stripe
Card details go directly to Stripe; they never touch our servers.
Delete documents or your account, yourself.
Both are in the app, under Settings, and you don't need to ask us. A document goes along with its file; deleting your account removes every document, field and file, and everyone loses access at once. We keep two things and say so before you confirm: what you were charged, so the money can still be accounted for, and the record that the deletion happened. Neither holds your documents.
Tell us.
Email [email protected] with the details. Please give us a chance to fix it before sharing it publicly.
Compliance certifications: on the way. Our Data Processing Addendum and Privacy Policy set out how we handle personal data.