Security

Last updated: 24 October 2026

Infrastructure

ReceiptMapper runs on Cloudflare Workers with a Cloudflare D1 database and Cloudflare Workers AI. Data is stored on Cloudflare's infrastructure, which encrypts stored data at rest. The site and the API are served only over HTTPS, and plain HTTP requests are redirected.

Encryption in transit

All traffic between your browser and the Service uses TLS. Receipt images are sent over encrypted connections to the AI model that reads them.

Passwords

Passwords are never stored in readable form. We store a salted PBKDF2 hash (100,000 iterations). Login, sign-up and contact requests are rate limited to slow down guessing.

Sessions

When you sign in we set a session cookie that is HttpOnly (scripts cannot read it), Secure and SameSite=Lax. We store only a hash of the session token and sessions expire after 30 days. Requests that change data are rejected when they come from another origin.

Receipt data

Receipt images are processed and are not kept. We store the extracted text fields in your account, and every read of that data is checked against your user ID, so other users cannot open your batches. Retention periods are in the Privacy Policy.

Payments

Payments are taken on Stripe's hosted checkout. Stripe is certified as a PCI DSS Level 1 service provider. Card details go to Stripe and never reach our servers. We only receive a payment reference, the amount and the plan, and we verify each payment with Stripe before unlocking credits.

Access to our systems

The admin area is limited to a short list of authorised email addresses and is hidden from search engines. We keep access to production data to what operating the Service needs.

Logging

We keep basic operational logs, such as the type of error when a request fails, so we can find and fix problems. Logs do not contain your receipt images or the extracted receipt text.

Your responsibilities

Use a strong password that you do not use anywhere else, keep it private, log out on shared devices, and tell us straight away if you think someone else has accessed your account.

Deleting your data

You can delete your account yourself from the Account page. This removes your profile, sessions, credits and stored receipt data. Payment records are kept without a link to your account because accounting law requires us to keep them.

Incidents

If we confirm a security incident that affects your personal data, we will tell the people affected and the relevant authority without undue delay, as the law requires.

Report a vulnerability

If you find a security problem, email support@receiptmapper.com with the details and steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data or disrupt the Service while testing. We do not run a paid bounty programme.