Security and data
How Recepta handles your data
Workspace data in Postgres, isolated per workspace; original receipts in Cloudflare R2 object storage (or the database where R2 isn't configured), never altered and served only to members allowed to see the expense.
What Recepta holds
- Receipt images, PDFs and forwarded receipt emails
- Expense details (merchant, date, amounts, tax as printed, categories)
- Reports, approval decisions and comments
- Team members' names and email addresses
How long it’s kept, and how to export or delete it
Finished reports, their expenses and original receipts are kept for the workspace's retention period (7 years by default, 3 to 10) and then deleted automatically; AI call logs and processed-email records after 90 days.
The full detail is in Recepta’s data export and deletion policy.
Who processes it
Service providers (subprocessors), each on our instructions and only for the purpose shown:
- Render: hosting, databases and backups, in the United States.
- Cloudflare: private file storage (R2).
- Resend: receiving forwarded receipts and sending notifications.
- Stripe: subscription and license payments (card details go to Stripe, never to us).
- Anthropic: reading receipts.
Questions and security reports
Recepta is run by New Odyssey. To ask what we hold about you, to have it exported or deleted, or to report a security problem, email clio@new-odyssey.com. The privacy policy covers the rest.