Security and privacy at PaperMole
How PaperMole looks after your company's receipts, money and people. Written for producers, production accountants and financial controllers. Last updated 2 November 2026.
In short
- Your company's data is walled off from every other company's in the database itself, and crew see only their own spend.
- There are no passwords to steal: sign-in is by a one-time code sent to your email.
- We never hold card numbers, only the last four digits.
- Receipts are stored in Sydney, encrypted, in private storage, and backed up daily. The app runs in Sydney too.
- Your data is yours. Export it any time; ask us and we delete it.
Who can see what
Every company is walled off. The rules that decide who sees what live in the database, not just in the app, so a mistake in a screen can't show one company's data to another. Every change to PaperMole is tested automatically against those rules before it goes live, including attempts to reach another company's data.
Roles are set per company. Admins run the company and its settings. Producers see and code every job, approve entries and export. Crew see only the receipts they captured or paid for, their own floats and trips, and what they're owed. Someone who works for two companies has one login, with a separate role in each, and each company sees only its own records of them.
Crew don't need a login to hold a float or be paid back. Only the people who capture receipts themselves sign in.
Signing in
PaperMole has no passwords. You enter your work email and type the six-digit code we send, which works once and expires. A lost or reused password can't open your account, because there isn't one. Signed-in sessions renew quietly and end when you sign out.
Only people your company adds can sign in. New companies come on board by a one-use link from the PaperMole team, not by open sign-up.
Your data
Where it's stored. Your receipts, figures and files are stored in Sydney, Australia, on Supabase (Amazon Web Services, ap-southeast-2). The app itself runs in Sydney too, on Vercel, so your data doesn't leave Australia as you use it. The one exception is reading receipts: each image is read by our receipt reader in Singapore, the closest region its host offers, and the result comes straight back to Sydney.
Encryption. Everything is encrypted on the way to and from PaperMole, and encrypted where it's stored.
Automatic trips are opt-in, set up by each person on their own iPhone. The phone sends PaperMole its location only at the moment they get into and out of their car, never during the drive. A recorded trip is visible only to the driver until they confirm it as a work trip; "Not work" deletes it. While a trip waits, its driver sees a small map of the likely route and an estimated street address at each end. A trip the driver confirms as work keeps its map as evidence for the claim, seen by the driver and the company's producers. "Not work" deletes the trip with its locations and route, and points that never pair are deleted after a day, so personal driving isn't kept. Only the phone can set a trip's map; nobody can draw or move one by hand. While a company car's logbook runs, a drive marked Private is kept as its distance only, with no places, map or purpose, seen only by the driver; producers see private kilometres only as a total. Each person's link can be turned off at any time.
Receipt files are kept in private storage. Each image is shown through a link that expires after ten minutes, so a copied link soon stops working.
Cards. PaperMole never sees or stores a card number. It keeps only the last four digits a receipt prints, to match receipts to the right card.
Backups. The database is backed up every day.
Your data is yours. Receipts, jobs and figures belong to your company. Export everything whenever you like: the Excel workbook, the Xero import files, the PDF pack and the original receipts as a zip. If you stop using PaperMole, tell us and we'll delete your company's data.
Services that handle your data
PaperMole uses a small number of specialist services. Each sees only what it needs.
| Service | What it does | What it sees |
|---|---|---|
| Supabase | Database, sign-in and file storage, in Sydney | Everything you store in PaperMole |
| Vercel | Runs the app, in Sydney | Data passing through as you use it |
| Railway | Runs the receipt reader, in Singapore | Receipt images while they're read |
| Anthropic (Claude) | Reads each receipt's vendor, date and amounts | The receipt image, under Anthropic's commercial terms, which don't use it to train models |
| OpenStreetMap | Turns where a receipt was captured into a suburb, and where a trip started and ended into an estimated street address | Approximate coordinates only, never the receipt |
| Google (Routes, Maps and Places) | Works out a trip's driving distance and draws its map; suggests places as you type a trip's From and To | A trip's start and end points, and what you type in those two boxes, nothing else |
| Resend | Sends sign-in codes and receives emailed receipts | Email addresses, and receipts you email in |
| GitHub | Holds the snag reports you send us | Your description, the screen it came from, and a screenshot link that expires after 30 days |
We don't sell your data or share it with anyone else.
The PaperMole team
The team can reach your data to keep the service running and when you report a snag or ask for help. We look only at what we need to fix the problem.
What we don't have yet
We'd rather tell you now than have you find out later:
- Two-step sign-in and single sign-on (signing in with Google Workspace or Microsoft). On the roadmap for larger companies.
- An audit log of who changed what. Approvals and payments are recorded with who did them and when; a full change history is on the roadmap.
- Point-in-time recovery. Daily backups mean the most we could lose in a disaster is part of a day. Finer recovery is switched on as companies come on board.
- An independent security audit (SOC 2 or TPN). Planned for when studio work calls for it.
Questions or concerns
Email hello@papermole.app. If you think you've found a security problem, tell us there and we'll respond quickly.