Security

Authentication

Sign-in is handled through Google OAuth, so Get Receipt never sees or stores your Google password. Sessions are managed by Supabase Auth.

Data access

Account and receipt data is stored in Supabase with Row-Level Security enabled, so records are scoped to their owner and one account cannot read another's data.

Payments

Payments are processed by Stripe. We do not store your full card details on our servers — card data is handled directly by Stripe, a PCI-compliant payment processor.

Transport and hosting

The application is served over HTTPS and hosted on Vercel. Application secrets and API keys are kept in server-side environment variables and are never committed to source control.

Reporting a vulnerability

If you believe you have found a security issue, please email support@get-receipt.com with the details. We appreciate responsible disclosure and will investigate reports promptly.