Data handling & security

Where your data lives

All storage and processing is in the AWS ap-southeast-2 region (Sydney). This is a deliberate choice: it keeps your financial records, and the AI processing that reads your receipts, onshore, which avoids the cross-border disclosure that sending data overseas for processing would otherwise create under APP 8 of the Privacy Act.

Tenant isolation

Every business or individual workspace is a separate tenant at the database level, enforced by row-level security policies on every tenant-scoped table — not by application code remembering to filter correctly. No request path used to serve your data is permitted to bypass that enforcement.

Encryption

• Data is encrypted in transit and at rest in storage.
• Particularly sensitive fields — bank account details appearing on a document, and the access tokens issued when you connect Xero — receive an additional layer of application-level encryption with a key managed through a dedicated key-management service, rather than relying on database-level encryption alone.

Card numbers

Some receipts print a partially masked card number. Any card number is reduced, at the point a receipt is captured, to only the last four digits and the card brand — the full number is never stored. This keeps Snap Apps out of card-data handling scope entirely, since there is nothing sensitive left to protect.

Photo location data

Photos can carry embedded GPS location in their metadata. That metadata is stripped from the copy used for processing and is never stored or indexed. Location is not something this product needs, and it is not collected.

The original image as evidence

The original receipt image is retained unmodified — never recompressed or edited — because the ATO only accepts an electronic record if it is a true and clear reproduction of the original. A separate, normalised copy is derived for the extraction model; the original is what is kept as your legal record.

Retention and deletion

Records are retained for five years from when they were prepared or the transaction they relate to completed, matching ATO record-keeping requirements, and are actively removed by an automated process once that period passes rather than kept indefinitely. See Data retention and deletion for the user-facing detail.

Breach notification

We keep an append-only audit trail of who accessed what, which is what makes it possible to scope a suspected breach quickly rather than guessing at its extent. Where a breach is likely to result in serious harm, we intend to notify affected individuals and the OAIC within 72 hours, consistent with the direction of reform to the Notifiable Data Breaches scheme.

Reporting a security issue

If you believe you've found a security vulnerability, please report it through Support rather than testing it against another customer's data.