Security

Your receipts hold your business's spending, suppliers and prices. Here is how Capplio keeps them safe.

• Each business is walled off. Every receipt, file and line item belongs to one business, and the database itself checks every request against your membership and role. This separation is covered by automated tests that run with every change.
• Roles. Staff can add receipts and see only their own, without amounts. Owners and admins see the whole business. Only owners manage the team's roles.
• Encrypted. Information is encrypted on its way to and from Capplio (HTTPS / TLS) and while stored. Sign-in keys for connected services such as Outlook are kept in an encrypted vault, separate from other data.
• Read-only email access. When you connect Outlook, Capplio can read, but never send, change or delete, your email, and it only opens messages that look like receipts. Disconnect at any time.
• Limited cloud access. Connected Google Drive, OneDrive and Google Sheets only let Capplio see the files and folders it creates.
• Private price data. Market averages need at least 5 businesses and 3 suppliers, and never include names. Your receipts are never shown to other businesses.
• Trusted infrastructure. Capplio runs on established providers (Supabase, Cloudflare, Google Cloud, Microsoft and Resend) that operate under independent security audits such as SOC 2. [Confirm each provider's current certifications on its trust page.]
• Backups and your own copy. We back up Capplio's data, and you can export your receipts or have them copied automatically to your own Google Drive or OneDrive.

Capplio runs on SOC 2–audited infrastructure. Need a security questionnaire filled in? Contact us.

Report a security issue

If you believe you have found a security issue, email support@capplio.com with "Security" in the subject line. We ask that you keep the details confidential until we have investigated and resolved the issue. We will acknowledge your report promptly and keep you informed of our progress.