Security
Your documents are invoices, statements and receipts. This page says exactly how they are handled, who else can touch them, and what we do not claim. Everything below describes what is running today.
Your account and your data
- We never store a password. Sign-in goes through Google, and we ask for two things: your name and your email address. There is no password of yours for us to lose.
- Card details never reach our servers. Checkout runs on our payment provider's own page. We see that a payment succeeded, and the last four digits on your receipt. Nothing more.
- One account cannot read another's documents. That is enforced in the database itself by row-level security, not only by our application code. We run an automated check against the live database that tries the attack and confirms it is refused — 31 probes across every table and privileged function.
- Encrypted in transit and at rest. HTTPS everywhere, with HSTS. Stored files are encrypted at rest by our storage provider.
How long files are kept
- The document you upload is deleted automatically within three days, whether the extraction finished, failed or was interrupted.
- The spreadsheet made from it stays in your library so you can reopen it. You can delete any document yourself, at any time, from your files list.
Full detail, including billing records, is in the Privacy Policy.
Who processes your data
These are every third party that can hold or handle your data. We do not sell data, and we do not use your documents to train anything.
| Who | What for | What they hold |
|---|---|---|
| Google Cloud | Hosting, file storage, document reading | Uploaded files, extracted output |
| Supabase | Accounts and database | Name, email, usage counts, document names |
| Dodo Payments | Payments and subscriptions | Billing details. We never receive card numbers |
| Cloudflare | Network in front of the site | Traffic in transit |
If you need a Data Processing Agreement, write to [email protected] and we will sort one out.
Checked by people who are not us
You do not have to take the section above on trust. Qualys SSL Labs rates the encryption this site serves, and you can run it yourself against parsebay.com:
- SSL Labs: A+ on every endpoint, tested 15 September 2026. TLS 1.2 is the minimum we accept; 1.0 and 1.1 are refused outright.
We will not put a grade here that we have not actually obtained, and we will re-test rather than leave an old one standing.
Hardening
- Sign-in tokens are verified cryptographically on our side, with the algorithm fixed by our configuration rather than taken from the token.
- Every capability link is compared in constant time, so a wrong one cannot be guessed by timing it.
- Uploads are checked for archive tricks — path traversal and decompression bombs are refused and reported back to you rather than dropped silently.
- Browser protections are set on every page: a content security policy, clickjacking and MIME-sniffing protection, a referrer policy, and a permissions policy that denies camera, microphone, location, payment and USB outright.
- Our dependencies are scanned for known vulnerabilities on every build, and a new one fails the build rather than waiting to be noticed.
- Secrets are held in a managed secret store. Deployments use short-lived federated credentials, so there is no long-lived key to leak.
What we do not claim
We are not SOC 2 or ISO 27001 certified, and we have not had a third-party penetration test. Those are audits by outside firms, and we have not bought one. We would rather say so here than have you find out during a procurement review.
We are also not set up for HIPAA-regulated data. If you are handling protected health information, we are not the right tool for it today.
What we do instead is written above, and most of it is checkable: the headers on this page, the sign-in flow, and the fact that a document of yours cannot be opened by anyone else.
Reporting a problem
Write to [email protected]. We will acknowledge within three working days and tell you what we fixed and when. Machine-readable details are at /.well-known/security.txt.
Please do not run automated scans against the live service, and please do not access, modify or keep data that is not your own — one account you control is enough to demonstrate almost anything. We have no bug bounty and cannot offer payment, but we will credit you if you would like that.