Security you can explain to your auditor

Every company's data lives in its own partition, and every request re-checks that the person is an active member of that company. Isolation is covered by automated tests.

Employees, managers, company admins and corporate admins each see only what their role needs. Managers lose access when people move teams.

Disabling someone ends their access on the next request — no waiting for sessions to expire — and re-routes their pending approvals.

Receipts are verified on upload (type, size, checksum), stored privately, and only shown to the owner, their approver and admins. No public links.

Receipt text is read on the employee's device. Images are not sent to third parties for scanning.

Every administrative change and every approval decision is recorded in an append-only audit log.

Accounting credentials are stored in a managed secret store per company, are write-only, and are never shown again.

Photos are re-encoded to remove location metadata; signing out clears cached data on the device.