Legal

Expensicat handles financial data. This page summarizes the measures we use to protect it.

Encryption

Data is encrypted in transit with HTTPS/TLS. Hosting and storage providers encrypt stored data, and Expensicat encrypts integration secrets with AES-256-GCM.

Tenant isolation

Storage records use database row-level security. Other tenant data is isolated through server-side authorization, current organization membership, scoped permissions, and organization-bound database queries.

Access controls

Access to production systems follows the principle of least privilege. Product access requires a verified session, API key, or OAuth credential, and authorization is checked on the server.

Infrastructure

We host and process data through the providers listed on our Sub-processors page. Their processing is covered by data processing agreements.

Monitoring and testing

We use error tracking and observability in production. Pull requests run dependency, secret, static-analysis, and configuration checks. Releases also scan container images for fixable high and critical vulnerabilities, and each image has a retained software bill of materials.

Backups

Residual backup copies follow the hosting provider's backup lifecycle and the retention terms in our Privacy Policy.

Compliance

We build to a privacy-by-design standard and align our practices with the GDPR. We process Personal Data only through vetted sub-processors under data processing agreements, and a Data Processing Addendum is available for business customers. We do not currently hold a SOC 2 or ISO 27001 certification; pursuing formal certification is on our roadmap, and we will update this page as our compliance posture matures.

Responsible disclosure

If you believe you have found a security vulnerability, please email security@quickbits.io (see our security.txt). Please give us a reasonable opportunity to investigate and remediate before any public disclosure. We appreciate responsible disclosure and will work with you to resolve valid issues promptly.