Data handling & security

Where your data lives

Your records and the original receipt images are stored on a server operated for us by Hostinger in Jakarta, Indonesia. To read a receipt, a copy of its image is sent to OpenRouter in the United States, which passes it to the provider running the model that reads it.

Both are disclosures outside Australia under APP 8 of the Privacy Act, and the Privacy Policy sets them out. Moving storage and receipt reading to Australia is planned; until then, this is the arrangement in use.

Tenant isolation

Every business or individual workspace is a separate tenant at the database level, enforced by row-level security policies on every tenant-scoped table — not by application code remembering to filter correctly. No request path used to serve your data is permitted to bypass that enforcement.

Encryption

• Data is encrypted in transit (HTTPS). The server's disk is not yet encrypted at rest; that is planned with the move to Australian hosting.
• Particularly sensitive fields — bank account details appearing on a document, and the access tokens issued when you connect Xero — receive an additional layer of application-level encryption with a key managed through a dedicated key-management service, rather than relying on database-level encryption alone.

Card numbers

Some receipts print a partially masked card number. Any card number is reduced, at the point a receipt is captured, to only the last four digits and the card brand — the full number is never stored. This keeps Snap Apps out of card-data handling scope entirely, since there is nothing sensitive left to protect.

Photo location data

Photos can carry embedded GPS location in their metadata. That metadata is stripped from the copy used for processing and is never stored or indexed. Location is not something this product needs, and it is not collected.

The original image as evidence

The original receipt image is retained unmodified — never recompressed or edited — because the ATO only accepts an electronic record if it is a true and clear reproduction of the original. A separate, normalised copy is derived for the extraction model; the original is what is kept as your legal record.

Retention and deletion

Records are retained for five years from when they were prepared or the transaction they relate to completed, matching ATO record-keeping requirements, and are actively removed by an automated process once that period passes rather than kept indefinitely. See Data retention and deletion for the user-facing detail.

Breach notification

We keep an append-only audit trail of who accessed what, which is what makes it possible to scope a suspected breach quickly rather than guessing at its extent. Where a breach is likely to result in serious harm, we intend to notify affected individuals and the OAIC within 72 hours, consistent with the direction of reform to the Notifiable Data Breaches scheme.

Reporting a security issue

If you believe you've found a security vulnerability, please report it through Support rather than testing it against another customer's data.