Your inbox stays yours. So does everything else.
Receipt Pair is built around a narrow job: read charges, find receipts, file them. Everything below is how the shipped product behaves, not a policy aspiration.
What Receipt Pair can and cannot do
Email: read only
Gmail access uses Google's read only scope. The app can search and download attachments. It cannot send, delete, label, or modify anything in your mailbox.
Bank: read only
Wise connects with a token that has no payment permissions. Receipt Pair uses it to read account activity. Stripe connects with a restricted key for ledger and Issuing read access.
No raw email stored
Receipt Pair reads your inbox to find attachments, then keeps only the receipt PDF. Message bodies and threads are not stored.
Purpose of access
Receipt Pair reads transaction and receipt data to match documents and send them to your connected accounting destination. See the privacy policy for data handling details.
How your data is kept
Encrypted credentials
API tokens and OAuth refresh keys are encrypted at rest with AES-256-GCM. Each business has its own encrypted records; one workspace can never read another's.
Isolated storage
Receipt PDFs live in private object storage under a prefix scoped to your business. Nothing is public, and nothing crosses between accounts.
EU infrastructure
The D1 database and R2 receipt storage are pinned to the EU. This storage location does not mean every processing or email service runs only in the EU.
Receipt extraction
Receipt OCR and enrichment use Cloudflare Workers AI. Extracted facts support matching and VAT classification; review uncertain results in the app.
Access on your terms
Teammates and accountants get their own logins and roles. Integration credentials are not shared with invited users. Self-service GDPR export and deletion are available in your account.
Account and request protection
Sign-in controls
TOTP multi-factor authentication supports authenticator apps and single-use backup codes. Turnstile checks protect registration and login.
Access records
Tenant-scoped queries and private receipt prefixes isolate workspaces. Data access is audit logged, and per-user rate limits restrict request volume.
Verified webhooks
QuickBooks and Xero webhook handlers verify HMAC-SHA256 signatures over the original request body. Xero webhook setup is live; QuickBooks console registration is pending. Outbound receipt events are also signed.
Export and deletion
Export or delete your workspace data using the account controls. Read the data guide before deleting a workspace.
The short version
- 01
Read only scopes for email and bank. Accounting connections separately need permission to upload receipts.
- 02
Credentials encrypted at rest. Receipts in private per business storage. Raw email never kept.
- 03
Questions or a deletion request: support@receiptpair.com. The details live in the privacy policy and terms.
Trust is the product.
Read only access, encrypted credentials, isolated storage. Then it does the boring work.
Start pairing free