Your invoices are financial records. We treat them that way.
Everything your security and compliance team will ask, answered here. Need the full questionnaire or a DPA? Download the security brief or write to security@[domain].
- Encrypted in transit and at rest
- Your invoices never train another customer's model
- Hosted in India, with EU and US regions on request
- SSO and role-based access
Data handling
- What we store: the invoice file, extracted fields, match results and the posting log. We do not store your ERP credentials in plain text; connector tokens are scoped to the doctypes and APIs listed on each integration page.
- Where: primary hosting in India ([cloud provider, region, verify]); EU and US regions available for enterprise contracts.
- How long: configurable retention per workspace; default [x] years to match statutory record-keeping, deletion on request within 30 days of contract end.
- Who can see it: your users, by role. Our engineers access customer data only through a logged, time-boxed support session you approve.
AI and model training
- Your documents and corrections improve matching rules inside your workspace only.
- We do not train models shared across customers on your invoices, and we do not sell or share extracted data.
- Third-party model providers, where used, are bound by zero-retention terms [verify provider and terms]. On Platform and Enterprise you can bring your own provider keys or a self-hosted model, so invoice text never leaves the providers you already trust.
- Every extracted field carries a confidence score and a link to the source region, so nothing is a black box to your reviewer or your auditor.
Encryption and access
- TLS 1.2+ in transit; AES-256 at rest [verify]
- SSO via SAML 2.0 / OIDC (Google Workspace, Microsoft Entra, Okta) for enterprise plans; MFA available on all plans [verify what is live]
- Role-based access: admin, reviewer, viewer; per-entity scoping for groups
- API keys rotatable; IP allow-listing on request
ERP connection safety
- Read-only lookups; posting only through the ERP's own document APIs
- Nothing written to the ERP database directly; every write is a normal document your ERP can reverse
- Full write log with user, time, document id and source file
- Connectors run outbound-only from your environment (Tally) or as a scoped app (ERPNext, SAP)
Operations
- Uptime target [99.9%]; status page at status.[domain]
- Daily encrypted backups; tested restore [frequency]
- Vulnerability scanning and dependency patching on a [cadence]; annual third-party penetration test [once done, state the date]
- Incident response: customers notified within [24] hours of a confirmed incident affecting their data
Compliance and paperwork
| Item | Status on launch |
|---|---|
| SOC 2 Type I | [In progress / target date] |
| ISO 27001 | [Planned] |
| DPDP Act 2023 (India) | Compliant by design [name the data principal rights supported] |
| GDPR | DPA available |
| DPA, MSA, security questionnaire (SIG Lite / CAIQ) | Available on request |
Security & integration brief
Gated PDF, 6 to 8 pages.
See it run on your invoices.
Send us 200 invoices from last quarter. In two weeks you get a written report: extraction accuracy by field, match rate against your ERP, straight-through rate, and every exception explained. No contract until you've seen the numbers.