Security
How we handle your documents
Receipts, statements, and pay stubs carry names, account numbers, and income. This page says what happens to them, in plain terms. It describes what is true today.
The live demo
- Not stored. Demo uploads are analyzed in memory and discarded when the result is returned. No copy is written to disk or to storage.
- Isolated. Each document is opened in its own short-lived process with a memory limit and a time limit, so a malformed file cannot affect other checks.
- Rate limited. Three uploads per visitor per day. Visitor IP addresses are hashed with a secret before they are held in memory, and the counters reset when the service restarts.
Encryption
Every upload and result travels over TLS. The website and the analysis service only accept HTTPS.
Training
We do not train models on the documents you check. Reading a document's fields uses third-party language models, sent only the pages being checked; see sub-processors.
Accounts, when they open
- Uploads go straight to private storage through short-lived signed links. Files are never public.
- Originals are deleted after 30 days by default (7 on Free, 1 to 365 days on Business). Results can be kept without the file.
- A delete button on every result removes the file immediately.
- Each organization's data is isolated, and every query is scoped to it.
Logging
We do not log document contents, extracted fields, or file names. Error reports record the type of error only.
Compliance
We plan a SOC 2 Type I audit within a year of first revenue. We will not show a compliance badge until it is earned.
Reporting a vulnerability
Email hello@fraud.works with the subject "Security". We reply within two business days.
Check your first document in under a minute.
Try the live demo on a sample or on your own file. No account needed.