Security overview

Isolation

Authenticated requests are scoped to company membership. Employee report ownership is enforced on the server, including downloads. Company administration is role-restricted. The owner dashboard does not expose expense contents.

Account and file protection

Passwords are salted and hashed. Session and recovery tokens are stored as hashes. Production requires HTTPS, secure cookies and an explicitly trusted proxy. Receipt scanning fails closed when the scanner is unavailable. Uploaded files are kept outside public static directories.

Payment and operations

Stripe-hosted pages collect payment details. Webhook signatures are verified and subscription state is reconciled with Stripe. Production storage encryption, independent backups, restore testing, mail delivery and external monitoring must be verified on the selected host before launch. No SOC 2 certification, zero-knowledge encryption or guaranteed uptime is claimed.