ExpenCSecurity and data protection
For finance teams, accountants and data protection officers: where your expense data is kept, how it is protected, and who can see it.
Last updated: October 2026
Where your data goes
Your stored data stays in Ireland.* Everything ExpenC stores (claims, receipts, accounts and backups) is kept in Amazon Web Services' data centre in Ireland.
Browser or phone
Every connection is encrypted (HTTPS).
Firewall and sign-in
A web firewall filters traffic before it reaches ExpenC.
Database and receipts
Encrypted, on a private network with no internet access.
Daily backup
Encrypted, and restorable to any minute in the last 14 days.
* The optional Scan receipt feature sends only the receipt photo to Anthropic (USA), without the employee's name, email or company. It reads four things: shop name, date, total and VAT. Claims entered by hand never leave Ireland. See the providers below and our Privacy Policy.
Who handles your data
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, receipt storage, backups and emails | Ireland (EU) |
| Anthropic | Optional receipt scanning: receives only the receipt photo, without the employee's name, email or company | USA |
Transfers outside the EU are covered by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
How your data is protected
Encrypted in transit
Every connection to ExpenC uses HTTPS, on the web and in the app.
Encrypted at rest
The database, receipt images and backups are encrypted on disk.
Private network
The database has no internet access. Only the ExpenC service can reach it.
Passwords
Stored only as Argon2id hashes, a modern one-way method. Nobody at ExpenC can see your password.
Sessions
Sign-ins expire on their own. Changing your password signs you out on every other device.
Login protection
Repeated failed sign-ins are blocked for 15 minutes, and a web firewall limits abusive traffic.
Company isolation
Each company sees only its own data. This is checked on every request and covered by automated tests.
Private receipts
Receipt images are never public. Only signed-in people allowed to see that claim can open them.
Browser protection
A Content Security Policy stops the app loading code from anywhere else.
Who can access your data?
In your company
Access follows each person's role. Employees see their own claims, managers see the claims they approve, and admins see the whole company.
At ExpenC
A small number of named staff can reach the systems. We look at your data only when you ask us for help, or when the law requires it.
Nobody else
We never sell your data, use it for advertising, or share it for anyone else's purposes.
Your records
Full audit trail
Every claim, approval, rejection and settings change is recorded with who did it and when.
Backups
Automatic daily backups kept for 14 days, plus a snapshot before every update to ExpenC.
Your own copy
Export approved claims to Sage at any time. Receipts are kept for 12 months; before they are deleted you get a full archive to keep for the six years Revenue expects.
When your subscription ends
We give you a copy of your data on request, then delete it within 30 days, and from backup copies within 90 days.
AI, incidents and agreements
Does ExpenC use AI?
Only for optional receipt scanning. When someone taps Scan receipt, Anthropic's Claude reads that one photo and fills in the shop name, date, total and VAT, which the person checks before saving. It can also flag a receipt that looks altered, for the approver to check. The photo is not used to train AI models. Every approval is decided by a person, and mileage rates and the Sage export follow fixed rules, not AI.
What happens if something goes wrong?
We are alerted automatically if the service has problems. If a security incident affects your data, we tell you without undue delay, and within 72 hours, so you can meet your own GDPR duties.
Who is responsible for the data under GDPR?
Your company is the data controller and ExpenC is the data processor: we handle your data only to provide the service, under a data processing agreement in line with Article 28 GDPR. See our Privacy Policy.