Last updated 28 July 2026
This page describes what's actually built today, not a target we're working toward. See our Privacy Policy for what we collect and why.
We never ask for read access, an API key, or OAuth credentials to your accounting system. There is nothing to whitelist and no credential to leak, because we never hold one in the first place — you upload files, we read them.
Every table — vendors, ledger uploads, statements, reconciliation runs — is protected by Postgres row-level security policies keyed to your organization. This isn't application-level filtering that a bug could bypass; the database itself refuses to return another organization's rows, no matter what query asks for them. The same isolation applies to file storage: your uploaded statements and ledger exports sit in a private bucket scoped to your organization only.
Email and password only — no third-party login is offered, so there's no OAuth attack surface. Passwords are hashed and never visible to us; authentication runs on Supabase Auth, not a homegrown system. Sessions use short-lived tokens (1 hour) with a longer-lived refresh token, so a leaked session doesn't stay valid indefinitely.
All traffic to and from the app is encrypted in transit (HTTPS/TLS). Data at rest is encrypted by our infrastructure providers (Supabase, Google Cloud) as a standard part of their platforms.
An uploaded statement is read by Google Cloud Document AI to extract its line items, then discarded from that step — the raw extraction output is archived privately for 12 months for audit purposes, org-isolated the same way everything else is. Nothing you upload is used to train a shared AI model.
Honestly: no SOC 2 report, no formal penetration test, no bug bounty program. This is a private preview run by one person. If either of those matters for your organization before you'd consider this, say so — it's useful to know what's actually blocking a real evaluation.
If you find a vulnerability, please email yossef@supplierrecover.com directly rather than filing it publicly. I'll respond and fix confirmed issues as quickly as I can.