Security Policy

Last updated: 23 July 2026 · How we protect your receipts and account data

1. Where your data lives

Receipt-Vault runs on infrastructure we operate ourselves, located in Canada. We do not use a third-party public cloud to host your receipts or account database.

A small number of service providers — some in the United States — perform specific functions such as AI extraction, payments and email. Each is listed, with what it can access, in our Privacy Policy.

2. Encryption

• In transit: all traffic between your browser or phone and Receipt-Vault is encrypted with TLS (HTTPS). This includes receipt uploads, downloads and API calls.
• Receipt links: the app accesses receipt images through short-lived signed links, so a link shared or forwarded from the app expires instead of working forever.
• Stored credentials: your PIN is stored only as a one-way bcrypt hash and cannot be reversed. Accounting-integration tokens (QuickBooks) are encrypted before storage.

3. Access control and authentication

• You sign in with your email and a private PIN. We never store the PIN itself.
• Sessions use randomly generated tokens; signing out immediately invalidates the session.
• Role-based access — owner, admin, bookkeeper and staff each see only what their role allows. Staff members see only the receipts they scanned.
• Rate limiting on sign-in, sign-up and PIN-reset endpoints to blunt brute-force and credential-stuffing attempts.
• Automated bot protection on sign-up.
• PIN-reset codes are generated with a cryptographically secure random generator and attempts are capped.

4. Keeping companies separate

Receipt-Vault is multi-tenant: many businesses use the same system. Every record is bound to a company, and separation is enforced twice — in the application on every request, and again in the database itself through row-level security. This is covered by automated tests that specifically try to read across company boundaries.

5. Internal access by our staff

Access to production systems is limited to authorized personnel, and used only where necessary for support, troubleshooting or maintenance. Personnel with access are bound by confidentiality obligations. We do not browse customer receipts, and we do not use your receipt content for any purpose other than providing the service to you.

6. Monitoring, logging and backups

• Audit log — key actions (sign-ins, scans, edits, deletions, exports) are recorded and visible to account administrators.
• Error monitoring — application errors are captured so we can detect and fix problems quickly.
• Backups — the database and receipt files are backed up nightly to separate storage; rolling backups are purged on the schedule set out in our Privacy Policy.

7. If a security breach happens

We maintain an incident-response process. If we discover a breach of security safeguards, we will:

1. Contain the incident and assess what information was involved;
2. Determine whether it creates a real risk of significant harm to any individual;
3. Where it does, report to the Information and Privacy Commissioner of Alberta without unreasonable delay, and to the Office of the Privacy Commissioner of Canada where federal law applies;
4. Notify affected customers, describing what happened, what information was involved, and what to do; and
5. Keep a record of security breaches as required by law.

8. Reporting a vulnerability

If you believe you have found a security vulnerability in Receipt-Vault, please tell us at privacy@receipt-vault.ca. Please give us a reasonable opportunity to fix the issue before disclosing it publicly. We will acknowledge your report and keep you updated. We will not pursue action against researchers who report in good faith and do not access, alter or destroy other customers' data.

9. Your part

• Choose a PIN that isn't guessable, and don't reuse one from elsewhere.
• Sign out on shared or public devices.
• Remove team members promptly in Settings when they leave.
• Tell us immediately at privacy@receipt-vault.ca if you think an account has been compromised.

10. What we're improving

We believe in being straight about where we're going rather than overstating where we are. Currently on our security roadmap:

• Two-step verification — a one-time code emailed at sign-up, plus an optional setting to require a code periodically or on new devices.
• Encryption at rest for stored receipt data, in addition to the encryption already applied in transit and to credentials.
• Continued expansion of automated security testing.

This section describes planned work, not current features. We will update this page as each item ships.

11. Contact

Security questions: privacy@receipt-vault.ca