Skip to main content
Walrus Receipts
Sign inStart free trial

Security at Walrus Receipts

Effective October 29, 2026

This is a draft for legal review, and a lawyer has not reviewed it yet. Bracketed placeholders are filled from the operator's configuration.

Receipts show where you go, what you buy and how you pay. This page explains in plain language how we protect them.

Your files

  • Receipts, reports and exports are stored in private storage. Nothing is publicly reachable, and the app shows files through signed links that expire after a few minutes.
  • Every upload is checked by its actual contents (not just its name), size-limited and re-encoded on our servers. We remove location and camera data (EXIF/GPS) from photos.
  • We rebuild PDFs without scripts, embedded files or automatic actions before anyone opens them.

Your account

  • Passwords need at least 12 characters. We store them with a slow, salted hash and check them against known data breaches.
  • Sign-in is rate-limited, and an account locks for a while after repeated wrong passwords.
  • Sessions use secure, HTTP-only cookies. You can sign out of all other devices from Settings, and changing your password does it automatically.
  • Deleting your account asks for your password again and permanently removes your data and files.

Your data

  • Every database row is locked to its owner with PostgreSQL row-level security. Automated tests prove that one user can't read, change or delete another user's expenses, receipts or reports.
  • Business tax IDs (EINs) are encrypted with AES-256-GCM, and showing one in full is recorded in an audit log.
  • All traffic uses HTTPS with HSTS. The web app sends a strict Content Security Policy and other protective headers.
  • Stripe handles payments, so card numbers never touch our servers. We only accept subscription changes from Stripe's signed notifications.

How we work

  • We use the OWASP Top 10 and the OWASP Application Security Verification Standard (Level 2) as a checklist.
  • We scan dependencies for known vulnerabilities and fix high or critical issues before release.
  • Secrets live in the hosting provider's encrypted configuration and never in the code.

Report a vulnerability

If you find a security issue, e-mail support@walrusreceipts.com with the details and the steps to reproduce it. Please give us a reasonable time to fix it before you disclose it, and don't access other people's data or disrupt the service while testing. We won't take legal action against good-faith research that follows these rules. Our machine-readable contact is at /.well-known/security.txt.