Where your documents go.

Private storage only

Uploaded files are written to a private storage bucket. No file you upload has a public address, and directory listings are not exposed.

Short-lived signed links

When you or a member of your workspace views a document, a signed link is generated that expires after a short window. Links are not shareable long-term and are not embedded in emails or reports.

Access scoped to your workspace

Access is granted through workspace membership, enforced in the database itself rather than only in the interface. A document belonging to one workspace cannot be read by another.

Roles

Owners and admins manage members. Auditors can create audits and upload documents. Viewers can read results but cannot upload, edit or delete.

Retention and deletion

Original uploaded documents are retained for 30 days by default. You can delete them sooner from the document controls in your account. Deleting an audit removes its documents and generated files.

Transport and storage encryption

Traffic is served over HTTPS, and stored files and database contents are encrypted at rest by the underlying infrastructure provider.

Passwords and sessions

Passwords are handled by a managed authentication service and are never stored by the application. Email verification is required, and password reset is available.

Analysis processing

Documents are processed by AI-powered analysis in order to produce your findings. Processing is a normal part of delivering the service, and we describe our data handling in the privacy policy rather than making blanket claims here.

No system is perfectly secure, and we will not tell you otherwise. We do not claim certifications we do not hold, and we do not promise a particular outcome from an audit. If you have a specific compliance requirement, contact us before uploading anything and we will tell you honestly whether we can meet it today.

If you believe you have found a vulnerability, email support@invoiceinvestigator.com with the details and how to reproduce it. Please do not access data belonging to other accounts while investigating.