How We Protect Your Data

Most expense apps require a live bank feed. That means your banking credentials sit with a third party. Ours don't, because we never have them.

• In transit: All connections use TLS 1.2 or higher. Nothing travels unencrypted.
• At rest: Data is stored with AES-256 encryption.
• Receipt images: Stored in private object storage. Images are not publicly accessible by URL alone.

• Every request is authenticated. You can only see your own data.
• Agency accounts are scoped: an agency can only access data for clients under its own account.
• We do not sell your data, and we do not use your receipts to train AI models.

Payments are handled entirely by Stripe, a PCI DSS Level 1 certified processor. Your card details never touch our servers.

Not yet — and we would rather tell you that directly than hide it.

RecSync is a bootstrapped Canadian company. A SOC 2 audit is on our roadmap as we grow. In the meantime: your data is encrypted in transit and at rest, hosted on SOC 2 and ISO 27001 certified infrastructure, we comply with PIPEDA (Canada's federal privacy law), and we never touch your bank login.

If your organization requires specific security documentation, email us at support@recsync.ai and we will answer your questionnaire directly.

• Export your data: One-click CSV export, anytime. Settings → Data & Privacy.
• Delete your data: Request permanent deletion anytime. Processed within 30 days.
• Full details: See our Privacy Policy.

We use a small number of vendors to run the service:

• AI extraction provider — reads receipt images for OCR. Images are not retained or used for model training.
• Stripe — payment processing (PCI DSS Level 1).
• Cloud infrastructure — database and file storage in Canada or the US.
• Email provider — transactional emails only.

We maintain an internal breach response plan. If a security incident creates real risk of harm to your data, we will notify affected users and the Office of the Privacy Commissioner of Canada, as required by PIPEDA.