Your receipts say a lot. We keep them to ourselves.
Expense reports hold names, places, amounts and pictures of receipts. Xpense encrypts what people write and attach, shows each person only what their role allows, and keeps a history of every change.
Encrypted in the database
Names, e-mail addresses, descriptions, places, comments, messages, receipt images and PDFs are stored encrypted (AES-256-GCM), with a separate key for each company. The database and its backups alone are unreadable; the keys are kept apart from it.
Access by role
Each company decides what its roles allow: approving, correcting, paying, seeing the accounting grid, managing people. Every request is checked against the person's roles, on the server.
Protected sign-in
Your e-mail address is confirmed with a code. Passwords need at least 10 characters and are stored only as a one-way hash (bcrypt). After 5 failed attempts, sign-in to that account pauses for 15 minutes.
A history of every change
Each report shows who submitted, approved, questioned, corrected or paid it, and when. Accounting corrections and changes to CRA values have their own logs.
AI only when you ask
Reading a receipt or translating a message uses an AI service, only when someone presses the button, with a daily limit. The system's operator can turn AI off entirely. Your data is not used to advertise to you or sold.
Where your data lives
Your data is stored in: Saint-Lazare (Québec), Canada. Connections to Xpense use HTTPS. The details are in our Privacy Policy.
You stay in control
See and take your data
Export the expense grid to Excel at any time, and ask us for a copy of the personal information we hold about you.
Correct or delete
Change your profile yourself. Ask us to correct or delete your information; records your employer must keep for tax purposes are handled with them.
Ask someone real
Questions about your personal information go to our privacy officer: [email protected].