Privacy and security

What is encrypted

kvitr encrypts stored invoice PDFs, extracted invoice fields, filenames, sender and subject details, saved connection credentials, supplier details, and workspace choices. It uses AES-256-GCM encryption, which also detects changes to encrypted data when it is read.

This is encryption managed by the service. kvitr’s servers can decrypt information to collect invoices, read PDF text, build reports, and deliver documents to authorized workspace members.

Connections in transit

The hosted app uses HTTPS between your browser and kvitr. Vercel invoice requests use HTTPS, and mailbox connections require TLS. Transport encryption protects those connections; kvitr still processes decrypted information on its servers to provide collection and review.

Information used to run the service

Not every stored value is covered by that application encryption. Account identity such as your name and email, password hashes, sign-in session records, workspace and record identifiers, provider identifiers, invoice dates, file sizes, and collection status are used to authenticate access and organize records.

Account sessions can include IP address and browser information. Your password is stored as a hash, rather than as readable text. A PDF’s stored contents are encrypted even though information needed to locate and organize the file is kept separately.

How connected accounts are used

Vercel tokens and mailbox passwords are decrypted on the server when a collection needs them. A Vercel token may permit more than invoice access; its scope and your Vercel role determine that access. Use a token for the intended team and revoke it when no longer needed.

Mailbox collection reads message metadata and downloads messages with attachments within the selected folder and period. It processes those messages to identify invoice PDFs. The saved invoice includes the PDF, sender, subject, and extracted fields.

For billing-dashboard connections, you sign in through a browser running on kvitr’s servers. Browser input and the provider session pass through that service. The saved provider session is encrypted and reused for later collections. It is not a browser running only on your device.

Automatic PDF reading runs within kvitr. It does not upload your invoices to an external AI extraction service.

Who can open your invoices

Invoices and connections belong to a workspace. The app checks the signed-in account and its current membership when opening workspace data or downloading a PDF. Owners, members, and viewers can download the workspace’s original PDFs; only owners and members can edit invoices.

The owner decides who to invite. Share a workspace only with people who should see all its invoices: cost teams and projects organize costs, rather than restricting document access.

Downloads are delivered to an authorized session and are not intended as public share links. A person who downloads a PDF has a separate copy they can retain or share.

Account emails

Verification and password-reset messages are delivered through the account-email provider. That provider receives the destination email and the message, including its verification or recovery link.

Account emails do not attach invoice PDFs. Invoice email forwarding has been removed; use the authenticated PDF view or download instead.

Disconnecting and retained invoices

Disconnecting a source removes its saved credentials and stops future collection through that connection. It does not delete PDFs already collected. Those records remain in the workspace for review and reporting.

Revoke the corresponding token, app password, or session at the provider if you also want to end its validity there. Removing a teammate’s workspace membership ends future workspace access but cannot erase their downloaded copies.