Your receipts and documents are business records. Here is how we look after them.
All traffic between your device and ReceiptRoo is encrypted in transit with TLS. Documents and extracted data are encrypted at rest with AES-256. Messages you send via WhatsApp are additionally protected by WhatsApp’s own end-to-end encryption on the way to our business account.
ReceiptRoo runs on cloud infrastructure platforms that hold SOC 2 and ISO 27001 certifications, with physical security, redundancy, and continuous monitoring managed at the data-centre level.
Access to production systems is limited to authorised personnel on a least-privilege basis. Within your account, team owners control who can submit, review, approve, and export documents. Every document carries a full audit trail — who submitted it, when, and what happened to it.
Your data is backed up regularly to protect against loss. If your account balance lapses after the trial, your documents are retained safely and access is restored when you top up.
We process personal data in line with our Privacy Policy, honouring data-subject rights under the EU/UK GDPR and applicable data protection laws in the regions we serve — including Singapore’s and Malaysia’s PDPA, Indonesia’s PDP Law, the Philippines’ Data Privacy Act, and Thailand’s PDPA.
You stay in control: export your records at any time, and request deletion of your account data whenever you choose.
Documents are retained for as long as your account exists, so your records are always available for accounting and audits. When you delete your account, associated documents and personal data are removed from live systems and purged from backups on their normal rotation cycle, except where a legal obligation requires longer retention.
We welcome responsible disclosure. Please report suspected security issues to hello@receiptroo.com and we will respond promptly. Please do not access data that is not yours or disrupt the service while testing.