Security & Responsible Disclosure

ReceWise uses safeguards designed to limit access to your account and purchase information.

Current protections include:

• Account-based data access: Application data is associated with individual user accounts, with database access controls designed to prevent one user from accessing another user's information.
• Private receipt storage: Uploaded receipt files are stored using private access controls and are provided to authorized users through controlled access mechanisms when needed.
• Protected communications: ReceWise and its infrastructure providers use encrypted connections for data transmitted between supported services.
• Server-side credentials: Sensitive API credentials and service keys are kept in trusted server environments and are not intentionally exposed to the browser.
• Server-side validation: Receipt-processing requests are validated for factors such as authentication, ownership, supported file type, and file size before AI processing is initiated.
• Usage protections: Scan and external-service usage is subject to server-enforced limits intended to reduce abuse and excessive automated activity.

These safeguards reduce risk but cannot eliminate it entirely.

ReceWise uses account authentication provided through its authentication infrastructure.

You are responsible for maintaining the security of your account credentials and should use a unique password where password-based authentication is used.

If you believe your ReceWise account may have been compromised, reset your credentials where available and contact:
security@recewise.com

Never send your password, API key, or other authentication secret by email.

ReceWise uses technical controls designed to:

• restrict users to information associated with their own accounts
• keep sensitive service credentials on trusted servers
• validate receipt-processing requests before external processing
• limit automated receipt scanning and other resource-intensive operations
• prevent unauthorized modification of internal usage and monitoring records
• isolate failures without exposing raw technical errors to users

Specific security mechanisms, thresholds, internal architecture, and detection rules are intentionally not published.

If you believe you have discovered a security vulnerability in ReceWise, contact:
security@recewise.com

Please include enough information for us to understand and reproduce the issue, such as:

• the affected feature
• steps to reproduce the behavior
• expected and observed behavior
• relevant screenshots or technical details that do not contain another person's private information

When conducting security research:

• test only with accounts and data you are authorized to use
• do not access, modify, download, or disclose another user's information
• do not perform denial-of-service, spam, destructive, or high-volume testing
• do not use social engineering
• do not intentionally expose confidential information
• give us a reasonable opportunity to investigate and address the issue before public disclosure

We appreciate good-faith reports and will review reports submitted in accordance with these guidelines.

If we become aware of a security incident involving personal information, we will investigate and take appropriate steps based on the circumstances.

Where notification is required by applicable law, Syncchat LLC will provide required notices to affected individuals or authorities within the applicable legal requirements.

No online service can guarantee absolute security.

ReceWise does not currently represent that it has obtained third-party certifications or audit reports such as SOC 2 or ISO 27001 unless expressly stated otherwise.

The safeguards described on this page may change as ReceWise and its infrastructure evolve.

Security reports: security@recewise.com

Privacy questions and requests: privacy@recewise.com

Syncchat LLC
Syncchat LLC, Minneapolis, Minnesota, United States