What we do with your invoices

The invoices your suppliers send you, and the emails that carried them. That includes the original attachment, the message body, the sender, and everything we read out of the document: line descriptions, quantities, rates, totals, ABNs and dates.

Receiving invoices by email is off for each organisation until an owner or admin turns it on in Settings. Each email is kept whole, exactly as it arrived, in our file storage in Sydney, with the sender check the email service reports: SPF, which says whether the server that delivered it may send for its envelope (bounce) address, not who wrote the From line. We also keep any DKIM or DMARC result an earlier server wrote into the email, as reported, not checked by us. While it is off, email sent to your address is kept but not read, and an email that fails a check from a sender you don't know waits for a person before anything is read from it.

The rate agreements you load, your supplier and project records, and the results of every check we run, including the findings we raise and the emails you send to suppliers about them.

For the people who use CostCode, an email address, a name and, if you choose to set one, a password. Passwords are held by Supabase as one-way hashes; nobody at CostCode can read them. You can always sign in with a code sent to your email instead.

Comments your team writes on invoices, and who wrote them. They stay inside your organisation: a comment can be hidden but is kept, as part of the invoice's record, and nothing in one is ever sent to a supplier.

A record of who accepted which version of our Terms of Service for your organisation, and when, kept for as long as the organisation exists.

To keep the Free plan to one per business, when an organisation is created we keep a keyed hash of the creating email address (never the address itself) for about 30 days, even if the organisation is deleted. When it is created through our website we also keep a keyed hash of the network address for about a day, to limit how many organisations one network can create. Each is deleted at the first sign-up after it expires.

If you follow a link a CostCode customer shared, we keep its eight-character code in a first-party cookie named cc_ref for 30 days, so the free invoices it offers still apply when you sign up. It holds nothing else, isn't used for tracking or advertising, and isn't read by anyone but us. When your business signs up, we record which customer's link it came through, and check that it isn't the same business referring itself: we compare the domain of the new owner's email address with the email domains of the sharing customer's members, and the two businesses' ABNs. Only whether they match is used; nothing about the sharing customer is shown to you. When your business first pays, that customer gets a credit on their CostCode bill; they see counts of businesses that signed up and paid through their link, never which ones.

Your records live in Australia. The database and the file storage are in Sydney (ap-southeast-2), and document reading runs in Azure's Australia East region.

A few of the services we rely on are based overseas, mostly in the United States. They are not where your records are kept, but some of them see parts of your data along the way. Each one is listed below with exactly what it sees.

A price list you import as a spreadsheet is read in your browser and saved with your records in Sydney; no outside service sees it. A price list or quote you import as a PDF is stored in Sydney while it is read, by Azure in Australia East, and deleted once it has been; the tables read from it are kept for a week, for the person who imported it to check and confirm, and nothing becomes an agreed rate until they do. To work out which column is which, the text of the price tables in it (their headings and first rows, which can include anything the supplier printed there, such as a job name or a site) goes to Anthropic in the United States, as the list below says. The PDF itself is never sent. Bank details printed on an invoice stay in the stored original: we don't pick them out into records of their own.

Original documents are stored in a private bucket, addressed by a hash of their contents and never modified after they arrive. That is deliberate: the original is the evidence behind any claim we help you make to a supplier, so it has to be the thing that actually landed in your inbox.

Apart from support access you switch on (below), only people you have invited into your organisation can see your invoices, rates, suppliers and findings. Separation between customers is enforced by the database itself, on every table, on every query, rather than by application code remembering to filter. No customer can read another customer's invoices, rates, suppliers or findings.

To run the service and answer support questions, CostCode staff can see account details: your organisation's name and ABN; the names, email addresses and roles of the people in it, when they last signed in and were last active, and what kind of device (phone, tablet or desktop) they were recently active on; your plan and billing status; your job names; and counts and rates, such as how many invoices arrived, how many are held or waiting for a person, how many findings were dismissed as not genuine, and what reading them cost us. Without your permission they cannot see what is on an invoice, your agreed rates, your suppliers or your findings.

Without support access, staff can also do a few things to keep your account running: add free invoices to your allowance, change your daily limits on supplier queries and assistant questions, pause or restore a person's sign-in (your owners are told by email while team email is on), resend an invitation, restart an invoice that is stuck partway through checking, sort invoice lines into trades, switch supplier email off, and ask you by email to switch support access on. Each of these is recorded in your activity log.

If you want us to look at something, an owner or admin can turn on support access in Settings, under Support, for a day, three days or a week. It switches itself off at the end of that time, and you can switch it off sooner. While it is on, our staff can read your records but not change them. If you also allow it, they can re-run checks and, when an owner allowed it, ask for an export, which is sent to that owner, not to us. When someone other than an owner turns support access on, your owners are told by email, unless team email is switched off in Settings.

When our staff open your organisation in our support console, look at your records or do anything in your account, it is recorded in your activity log as CostCode support; when they read your records or change anything, with the reason they gave. Lists that cover every customer, such as organisation names, plans and counts, are recorded in our own staff log instead.

Our staff may also keep a short note about your organisation for their own use, such as the best way to reach you, and may mark an organisation as one of our own test accounts so it is left out of our totals. Writing or changing the note is recorded in our own staff log rather than your activity log. The note is not part of your export, and it is deleted with your organisation. You can ask us what it says, as with anything else we hold about you (below).

Our staff can never send anything to a supplier, turn supplier email on, set or change a check's result by hand, or undo a decision someone at your company made.

Every consequential action inside your account is recorded in an append-only log: who did it, what changed, and when. That log cannot be edited by anyone, including us. It is deleted only when you delete your organisation, and a separate record that the deletion happened, by whom and when, is kept. Our own record of staff requests keeps which member of staff made each one, the kind of request, which organisation and record it was about, and when; never the reasons given or anything written in your records.

Nothing sends itself. Email to suppliers is off for every organisation until an owner or admin turns it on, and even then no message reaches a supplier without a person at your company reading it and pressing send, and that action is recorded against their name.

A supplier only ever sees evidence drawn from your own dealings with them: the rate you agreed with them, the arithmetic on their own invoice, or the fact that they have sent the same invoice twice. What you paid other suppliers, and anything derived from another business, can never appear in a message to a supplier. That restriction is built into the code as a type rule with a test whose only job is to fail if it is ever weakened.

When a query is sent with replies coming back through CostCode and a week goes by without an answer, we draft a follow-up; it waits for a person to send it, like the first. A reply that comes back through CostCode, and anything attached to it, is kept with the query it answers.

An owner or admin can ask a supplier to confirm a schedule of rates. The supplier gets a link, which works for 30 days without an account, to a page showing that schedule's items and rates and nothing else of yours. We keep their answer, the name they give and any notes, and show them to your team.

If your organisation verifies its own email domain, queries go from the address of the person who pressed send instead of ours. The email service holds the domain and the keys it signs with; your DNS carries the matching records.

We are building a record of prices from checked invoice lines, to improve the product over time. It isn't collecting yet; when it is, the rows go to a completely separate database with no connection back to your account. An owner or admin can leave your organisation's prices out at any time in Settings, under Account, and then nothing from your invoices is written there.

Buyer and supplier identities are replaced with keyed hashes before the row is written, location is recorded no more precisely than the state, and there is no function anywhere in the system that reads this data back. While you are a customer, only our own pipeline could compute which rows are yours. Your organisation's hash is also salted with a random value kept for your organisation alone, and deleting your organisation destroys that value. After that, nobody, including us, can connect those rows to you. That is why deletion does not need to remove them. No aggregate drawn from them is ever shown to a supplier.

We use a small number of services to run CostCode. Each one is listed with what it sees.

• SupabaseDatabase, sign in and file storage. Hosted in Sydney. Holds everything above.
• Microsoft AzureReads the invoice document and returns the lines. Australia East region. We delete its copy of the reading result as soon as we have collected it; if that delete fails, Azure removes it within 24 hours on its own.
• VercelRuns the website, the application and the support console our staff use. Keeps short-lived request logs; never your documents.
• PostmarkReceives the invoice emails your suppliers send, and their replies to your queries, and delivers the emails CostCode sends: queries you send to suppliers, requests to confirm a schedule of rates, invitations, and the held-invoice emails, digests, summaries and payment run email to your team, and an email telling a colleague you mentioned them in a comment, with the comment, emails asking a colleague to approve a change (what the change is: the supplier, schedule or invoice and its total, and who asked) and telling the person who asked what was decided, with any note, and an email to your owners and admins when email to your CostCode address stops arriving. Based in the United States, so invoice emails pass through it on the way to us, and it keeps copies for a limited period under its own retention settings. Messages sent through our contact form reach us through it too.
• AnthropicPowers the assistant and sorts invoice lines into trades. When you ask the assistant something, your question and the records needed to answer it, such as supplier names, invoice totals, the words on invoice lines, agreed rates and which of your team has a held invoice, go to Anthropic's API in the United States. The description and unit of each invoice line we can't sort ourselves go there too, so it can be sorted into a trade: as an invoice is read, and once for lines on invoices read before we began sorting them. We don't send the supplier's name with them, though a line's own words can name a brand, an address or a person. When you import a price list or quote as a PDF, the text of the price tables in it (their headings and first rows, which can include anything the supplier printed there, such as a job name or a site) goes there too, so it can say which column is which; the PDF does not. Invoice and price list documents are never sent, and Anthropic does not train its models on this data.
• InngestCoordinates the processing pipeline. Based in the United States. It sees internal record identifiers and the text of processing errors. Anything read from an invoice is encrypted with a key only our servers hold before it reaches Inngest.
• ResendSends sign-in emails. Sees your email address and the one-time code.
• StripeWill take payment for paid plans once billing is switched on; until then nobody is charged and Stripe holds nothing about you. It will hold your billing details and card, which CostCode never sees, never your invoices. Based in the United States.
• PostHogReceives reports of errors in the website and the processing pipeline, and counts of steps through the product (a free check started and how it ended, a sign-up link followed, an organisation created), once we switch it on. An error report carries the kind of error, where in our code it happened, internal record identifiers, and a message with email addresses, long numbers, amounts, quoted text and the query part of any web address removed. A step carries a fixed code, a count, and either a random identifier or your organisation's internal identifier. Neither is built to carry invoice contents: we never put documents, invoice text, amounts, your name, your email address or what you typed into them, and the removal in error messages is a second safeguard against our own mistakes rather than the first. PostHog does not receive the requests themselves, and everything is sent from our servers, not your browser, so it does not see your IP address. Based in the United States.
• Google AnalyticsCounts visits to our public pages: the home page, pricing, the free check, the fuel levy calculator, the free templates, the guides, the pages for trades or bookkeepers, the comparisons, help, contact, security, status, the terms, sign in and this page. It sets cookies and sees which of those pages you opened, your browser and device, and an approximate location. We also tell it what you used on those pages, each time as a fixed code or a count, never anything you typed or uploaded: on the free check, that the sample was shown, that a check was run and how it came out with how many findings it raised, how many invoices a batch had and how many were checked, and that a result was emailed or shared; on the fuel levy calculator, which mode was used and which kind of result it gave; that a sign-in link was asked for; and how a check was started on the home page, that its sample held invoice came into view, and its share and sticky buttons. It never runs inside the signed-in app, so it never sees your invoices, suppliers or rates, and nothing from a document you put through the free check beyond how its check came out. Based in the United States. Google's opt-out add-on (tools.google.com/dlpage/gaoptout) or your browser's tracking protection turns it off.
• Google AdsTells us whether our ads on Google Search lead anywhere. Through the same Google tag, on the same public pages, it is told when someone sends our sign-up form or the free check reads and checks one of their invoices, so Google can match that to a click on one of our ads and show us what the ads cost per result. It sees which of our ads you clicked, if you came from one, the page (its address without anything after a question mark), your browser and device, and an approximate location. It also sees the page your browser says you came from, which is the page that led to the one you're on or, if you moved around our site without a full reload, to an earlier page of ours: another site by no more than your browser gives, usually just its address; one of our public pages by its address without anything after a question mark; and a page inside the app by only our site's address. It sets no cookies on our site and keeps no record of an ad click here, so it can match a sign-up or a check to your click only while you stay in the browser tab the ad opened. Its page view goes to a Google advertising domain and, if your browser allows cookies from other sites, carries any cookie Google already keeps there. It is never sent your email address, anything you typed or anything from a document you checked, and we don't use it to build advertising audiences or to show you ads elsewhere. It never runs inside the signed-in app. Based in the United States. An ad blocker turns it off.

We do not sell your data, and beyond the Google Ads measurement above we do not share it with anyone for advertising. If we add a service that processes your invoices, this list changes with it.

You set a retention period in Settings (the ATO generally asks businesses to keep records for five years, and some for longer). The original files (PDFs, photos and the emails they came in) are deleted once they are older than that period, after an email to your owners at least 30 days before; if that email can't be sent (team email off, say), nothing is deleted. A file whose invoice is still held, being checked, under query with the supplier or with a finding still open, a price list an agreement still uses, and an email waiting for someone to release it are kept until that is settled. The records of what was checked stay until your organisation is deleted.

You can delete your organisation at any time. Your invoices, rates, findings and supplier correspondence go straight away, and the original documents are removed from storage by a background job within minutes; nobody can open them in between. The anonymous price rows described above cannot be identified as yours and so are not part of that deletion. The deletion itself is recorded: who did it, when, and how many invoices and documents went, with no names and no invoice details, so we can answer “who deleted our account?” if anyone ever asks.

Before you delete, an owner can export everything from Settings: every record as a spreadsheet file per table, and every original document. The download links are in Settings for the organisation's owners, are emailed to the owner who asked while the organisation's team email is on, and last 24 hours; the files are deleted from our storage a day after they are made.

A message through our contact form is kept with the email address you give, your name if you give one, the topic you pick, and a keyed hash of your network address (the same kind the free check uses, never the address itself) to limit how often the form can be used. It is emailed to our own inbox through Postmark, and deleted from our database twelve months after you sent it, so we can answer it and see what was asked before. We never email anyone else from it.

The check on our website reads the file you upload and shows you what it found. The file is not saved. It is held in memory for the length of the request, read by Azure in Australia East, and discarded. It never reaches either database.

To limit how often the check can be used, we count checks against your IP address. The count is kept either in the memory of the server that answered, which forgets it, or in our database as a pseudonymised form of the address (a keyed hash, whose key is held apart from the database, not the address itself), with the time and the number of pages read, for 24 hours, and then deleted. We also count that a check was started and how it ended, under a random identifier and with nothing from the file (PostHog, above).

If you follow “Save this result” to open an account, the file you checked and the bill-to ABN are kept in your own browser, not on our servers, for a day at most, so the new account can offer to add them. A random mark in that browser tab's session storage says the file is yours, so another tab, or the next person on a shared computer, is never offered it pre-ticked. Nothing reaches us until you add the invoice yourself.

Write to hello@costcode.co, or use the contact form, for a copy of what we hold about you, to correct it, or to have it deleted. Tell us if you think something has gone wrong with your data and we will tell you what happened.