Written from the implementation.

InvoiceAI processes accounts-receivable, accounts-payable, and employee-expense data on behalf of the businesses that sign up (our customers): invoices, bills, payments, expense claims and receipts, card-transaction records, vendor and customer contact details, and the documents behind them. For those businesses we are a processor; the business remains the controller of its books. Employee expense data — receipts, merchants, locations — is workforce data and is visible only by role: employees see their own claims, approvers and finance see the program.

About you as our direct customer we hold your account (name, work email, phone), your workspace's subscription state, and an immutable audit trail of administrative actions in your workspace.

Data lives in Oracle Cloud Infrastructure (US region), encrypted in transit and at rest. Bank account numbers and taxpayer IDs are additionally sealed with authenticated encryption — working screens show last-four only. Every table is tenant-isolated down to the database's own row-level security, and every administrative action lands in an append-only audit log.

When AI reads your documents or drafts a message, the text passes through our masking gateway first: personally identifying values are masked before anything reaches a model provider, and model versions are pinned per purpose. Model providers are processors under their business terms; your data is not used to train their models.

Oracle Cloud Infrastructure (hosting, storage), Cloudflare (DNS, web delivery), Amazon Web Services SES (email sending and receiving), Stripe (payment processing for money you collect), BillAI (our subscription billing), and the pinned AI model providers (Anthropic, Google) behind the masking gateway.

Export: a workspace owner can export every record plus all document originals from Settings → Privacy & data — a zip with a 7-day download link, on demand.

Deletion: an owner can close the workspace. It becomes read-only for a 30-day grace period (cancelable), then everything is permanently erased. What remains, deliberately and briefly: document originals and backups until their retention windows below expire, the audit record that the closure happened, and billing history with our billing provider.

Erasure requests from people inside the data: when a person at one of your customers asks to be forgotten, the Anonymize action erases their contact details and message contents while the financial records (invoices, payments) remain under an anonymized label — records the law requires businesses to keep.