What we do with your invoices

The invoices your suppliers send you, and the emails that carried them. That includes the original attachment, the message body, the sender, and everything we read out of the document: line descriptions, quantities, rates, totals, ABNs and dates.

The rate agreements you load, your supplier and project records, and the results of every check we run, including the findings we raise and the emails you send to suppliers about them.

For the people who use CostCode, an email address and a name. Sign in is a link sent to your email, so we hold no passwords.

In Australia. The database and the file storage are hosted in Sydney (ap-southeast-2), and document reading runs in the Australia East region. Your invoices are not moved offshore.

Original documents are stored in a private bucket, addressed by a hash of their contents and never modified after they arrive. That is deliberate: the original is the evidence behind any claim we help you make to a supplier, so it has to be the thing that actually landed in your inbox.

Only people you have invited into your organisation. Separation between customers is enforced by the database itself, on every table, on every query, rather than by application code remembering to filter. No customer can read another customer's invoices, rates, suppliers or findings.

Our staff do not read your invoices as a matter of course. Access for support happens only when you ask for it and when there is a specific problem to look at.

Every consequential action inside your account is recorded in an append-only log: who did it, what changed, and when. That log cannot be edited or deleted, including by us.

Nothing sends itself. No message reaches a supplier without a person at your company reading it and pressing send, and that action is recorded against their name.

A supplier only ever sees evidence drawn from your own dealings with them: the rate you agreed with them, the arithmetic on their own invoice, or the fact that they have sent the same invoice twice. What you paid other suppliers, and anything derived from another business, can never appear in a message to a supplier. That restriction is built into the code as a type rule with a test whose only job is to fail if it is ever weakened.

We record price observations from processed invoice lines, and we use them to improve the product over time. They are stored in a completely separate database with no connection back to your account.

Buyer and supplier identities are replaced with irreversible hashes before the row is written, location is recorded no more precisely than the state, and there is no function anywhere in the system that reads this data back. Because these rows cannot be traced to a customer, deleting your organisation does not remove them, and no aggregate drawn from them is ever shown to a supplier.

We use a small number of services to run CostCode. Each one is listed with what it sees.

• SupabaseDatabase, sign in and file storage. Hosted in Sydney. Holds everything above.
• Microsoft AzureReads the invoice document and returns the lines. Australia East region.
• PostmarkReceives the invoice emails your suppliers send, and delivers the messages you send back to them.
• VercelRuns the website and the application. Handles requests; stores nothing itself.
• InngestRuns the processing pipeline. Sees record identifiers, not invoice contents.

We do not sell your data, and we do not share it with anyone for advertising. If we add a service that processes your invoices, this list changes with it.

We keep your invoices and their evidence for as long as your organisation exists. The working assumption is seven years, because that is the period Australian tax record-keeping expects, and your organisation can set its own figure in Settings.

You can delete your organisation at any time. That removes your invoices, documents, rates, findings and supplier correspondence. The anonymous price rows described above cannot be identified as yours and so are not part of that deletion, and the deletion itself is recorded.

The check on our website reads the file you upload and shows you what it found. The file is not saved. It is held in memory for the length of the request and discarded, and it never reaches either database.

Write to privacy@costcode.co for a copy of what we hold about you, to correct it, or to have it deleted. Tell us if you think something has gone wrong with your data and we will tell you what happened.