How does ExpenseBot keep my data secure?

Where your data actually lives

• Your reports and spreadsheets: in YOUR Google Drive, under your Google account. We don't keep a copy. Once a report PDF or sheet is created, the file belongs to you — if you disconnect ExpenseBot tomorrow, those files stay in your Drive intact.
• Receipt images and PDFs: also stored in YOUR Google Drive (the ExpenseBot folder we create on your account), not on our servers. During processing we pass them through Google Cloud Storage briefly to run OCR and classification, then upload the final file to your Drive and the temporary copy is removed.
• What we DO keep on our side: your account settings, role configuration, integration credentials, the spreadsheet/folder IDs we created for you, processing outcomes, lineage and deduplication references, security and audit records, entitlements, and lightweight learning hints. This operational metadata is stored in Firestore (Google Cloud), encrypted at rest. We do NOT keep a permanent copy of your Google Sheet rows — the working ledger lives in your Google Sheet.
• What we DON'T store permanently: email bodies, your broader inbox contents, or anything unrelated to providing and supporting the service.

Email scanning specifics — the narrowest scopes that get the job done

• gmail.readonly — search and read likely financial messages through the mode you choose: selected or labelled messages, recent messages found by daily automation you enable, or a historical date range you request.
• gmail.modify — only used to apply our own labels ("Processed", "Receipt") so we don't re-process the same message.
• drive.file — this one's important: we can ONLY see files our app creates. Your other Drive files are completely opaque to us. We cannot list, read, or modify anything we didn't create.

You can review the granted scopes any time at myaccount.google.com → Security → Third-party apps, and revoke our access there with a single click.

Who can see your data on our side

Currently, access is limited to the founder (Rob) for support purposes — for example, reproducing a bug you've reported by reading the relevant rows in your spreadsheet or your settings in Firestore. That access is manual, ad-hoc, and tied to your specific support request. As the team grows we'll add formal access logging.

Who can open the receipt and report files in your Drive

This depends on the kind of Google account you signed in with.

• Google Workspace accounts (your own company domain): files stay private. Nobody can open a receipt or report by URL. When you share a report, recipients are granted access individually by email address. This is automatic for any Workspace (non-Gmail) account — there is nothing to configure.
• Personal Google accounts (gmail.com and similar): receipts, and reports created going forward, use an "anyone with the link" permission that is view-only. The links are long, unguessable, and are never published or indexed. Anyone you explicitly add as a recipient — sharing a report, or connecting an accountant — is granted their own named permission on that file, the same way Workspace accounts already work, instead of relying on the link to edit. (Reports created before this changed on 2026-09-27 keep their original link permission; we are not updating those retroactively.)

If you are on a personal account and want your files locked down regardless, contact support and we will switch your account to restricted sharing. Existing files are updated too, and sharing a report afterwards still works — recipients are added by email instead of by link.

Third-party services we use, and what each gets

• Google Cloud (Firestore, Cloud Storage, Cloud Run): document processing, temporary OCR objects, and limited operational metadata. Subject to Google's data processing terms.
• Google Gemini API (paid tier): receipt OCR and category classification. Per Google's published terms for the paid API tier, prompts and responses are NOT used to train Gemini.
• Vercel: the ExpenseBot web and API layer.
• Twilio SendGrid: transactional and service email. Expense data is not included unless it is necessary for the user-facing notification requested by the feature.
• Stripe: billing only. They see your subscription info, never your expense data.
• Plaid (optional, only if you connect a credit card): bank transaction metadata for reconciliation. Connected by you; revocable at any time.
• Google Analytics, Microsoft Clarity, and LinkedIn Insight Tag: product usage, device, referral, and acquisition analytics.

Processing regions and UK/EEA deployments

• Durable receipt files, reports, and spreadsheets are stored in the user's Google Drive. Their location follows the user's Google account or Workspace configuration.
• Primary document and Gmail processing runs on Google Cloud Run in Montreal, Canada (northamerica-northeast1).
• Temporary OCR objects pass through the expensebot-ai-photos Google Cloud Storage US multi-region bucket and are removed after processing.
• Limited operational metadata is stored in Firestore's United States Central multi-region (nam5).
• Vercel functions run in Washington, D.C., United States (iad1); static content uses Vercel's global network.

ExpenseBot does not currently offer UK-only or EEA-only residency. Google Cloud and Vercel provide contractual transfer safeguards in their applicable data-processing terms. The public Privacy Policy is the source of truth for current regions, transfer disclosures, retention criteria, and privacy rights. Do not describe ExpenseBot as "GDPR compliant," "SOC 2 Type II compliant," "HIPAA ready," or as storing all data only in Google Drive unless a current legal/security review establishes that exact claim.

CASA Tier 2 security assessment

ExpenseBot completed its 2026 CASA Tier 2 assessment through a CASA-authorized independent assessor. The assessment covered:

• Secure secret management and credential handling
• HTTPS-only connections with TLS 1.2+ encryption
• Secure cookie configurations
• Protection against common attack vectors (XSS, CSRF, injection)
• External penetration testing with verified pass results
• 54 OWASP-based security controls documented and validated

The assessment was conducted by ESOF AppSec (TAC Security), a CASA-authorized independent assessor. Our 2026 assessment completed in April 2026. A successful assessment validates the controls in scope; it is not a blanket Google endorsement of ExpenseBot or a substitute for a customer's own vendor review.

If you want to share this with a client

The full FAQ — including this entry and the other Privacy & Security items — lives at expensebot.ai/faq#privacy. Forward that link directly to any client who needs the answers.