Where Your Documents Go: Privacy Architecture for Financial Data

2026-10-05 Sheece Gardezi privacysecurityarchitecture

When you hand a receipt capture tool your clients' financial documents, where do they go? In SnapReceipt, the answer is short enough to fit in one paragraph: your receipt images are held in encrypted object storage, extraction runs through the proprietary pipeline we engineered in-house, and your account data and extracted results live in a PostgreSQL database in the same Hong Kong region, encrypted in transit with TLS. No Google Document AI, no AWS Textract, no Azure Form Recognizer, and no third-party analytics of any kind. The complete, named list of infrastructure providers is in our privacy note. That is the whole answer, and the rest of this post is the detail behind it, including the parts most vendors prefer to leave vague.

We think that level of specificity matters. Bookkeepers, accountants, and anyone handling other people's financial records have confidentiality obligations that don't pause because a SaaS vendor's marketing page says "we take privacy seriously." So this post walks the actual path a receipt takes through SnapReceipt, states what we do and don't do, points to the named infrastructure providers in our privacy note, and ends with a checklist you can use to interrogate any vendor (including us).

The third-party API problem

Here is the architecture behind a large share of the receipt capture market. The vendor's app takes your photo, then forwards it to a document-AI service run by a hyperscaler: Google Document AI, AWS Textract, and Azure Form Recognizer are the common choices. The vendor's product is effectively a wrapper: their servers orchestrate the job, but the actual reading of your client's invoice happens inside someone else's model, on someone else's infrastructure, under someone else's data-processing terms.

To be clear, this is a description of common industry architecture, not an accusation aimed at any specific competitor. Those document-AI services are competent, and the vendors using them will usually tell you if you ask directly or read their subprocessor lists. The problem is that most customers never ask. The marketing page says "AI-powered extraction" and stops there.

For a firm with confidentiality obligations, that omission can be a dealbreaker. Your client's invoice contains their supplier relationships, their pricing, their ABN, sometimes their home address. When that image transits a third-party document-AI API, you've added a data processor to your client's financial life, possibly one whose terms you've never read and whose retention behavior you can't audit. Some of those services reserve rights you'd rather they didn't have; even when their terms are fine, you now owe your client an honest answer about how many companies touched their documents, and "I'm not actually sure" is a bad answer.

SnapReceipt's architecture, end to end

So here is exactly what happens to a receipt in SnapReceipt, from upload to storage. This is the real production architecture, not an idealized diagram.

Upload and queuing

Your image goes from the app to our API over HTTPS. The API runs on our own server: a single Alibaba Cloud ECS instance in Hong Kong, sitting behind a TLS-terminating proxy. Cross-origin access is restricted to an explicit allowlist of our own origins, and every API route except the health check requires a signed session. Uploading a receipt doesn't run extraction inline; it enqueues a job and returns. A background worker then picks the job up.

Extraction: our in-house pipeline, end to end

Extraction is where our engineering lives. The document-reading pipeline itself, the part that turns a crumpled photo into structured, typed, arithmetic-verified fields, is proprietary and built entirely in-house; we don't license a document-AI product from anyone, and there is no third-party document-AI service in the path. Our pipeline is deployed and operated by us, on infrastructure we control, and the complete, named list of infrastructure providers involved in running the service is maintained in our privacy note, and we claim nothing here that the privacy note doesn't back.

What we can say precisely:

We do not use Google Document AI, AWS Textract, or Azure Form Recognizer. There is no third-party document-AI OCR service in the pipeline at all: the reading, structuring, and validation logic is our own in-house pipeline.
The extraction result isn't taken on faith. Every result goes through our in-house validation layer that cross-checks the arithmetic (line items against totals, totals against tax) before it's shown to you. If the numbers don't add up, you see that, not a silently wrong spreadsheet. You can see this demonstrated on the landing page.

Storage

After extraction, two things persist:

The image. Receipt images are held in encrypted object storage, readable only by the Hong Kong server during processing.
The results and your account data. Merchant, date, totals, line items, and your account details live in a PostgreSQL database in Alibaba Cloud's Hong Kong region. Connections to it require TLS, and network access is allowlist-only: the database does not accept connections from the open internet.

Compute and database are in Hong Kong, and object storage is separate from both. Where document data sits, the complete list of providers, is stated in our privacy note.

Analytics: self-hosted, because third-party analytics is still third-party

Most marketing sites and apps pipe your behavior to Google Analytics, PostHog, Mixpanel, or an ad tracker, and treat that as unrelated to "your data." We disagree. Behavioral data about how a firm handles financial documents is still data about that firm. So SnapReceipt's analytics are self-hosted, on both the landing site and the app.

Concretely: the landing page sends named events (page views, button clicks, scroll depth) to our own API, which writes them to our own database. PostHog used to be in the stack; it has been removed. There is no Google Analytics tag, no tag manager, and no advertising tracker anywhere on the site. Session recordings, used to debug the in-app experience, are also self-hosted, and everything you type is masked out of the recording. On the privacy details: IP addresses are stored only as one-way hashes. Your raw IP is never persisted.

The anonymous identifier that ties a landing visit to an app session is a random ID in your browser's local storage, mirrored to a first-party cookie on our own domain. No cross-site tracking, no advertising identifiers, and nothing is shared with or sold to anyone. As our privacy note states: all analytics data stays on our own self-hosted infrastructure and is not shared with third parties.

Data deletion

The privacy note is the authoritative statement here, and it says exactly two things, so those are the two things we'll claim:

You can delete individual receipts in the app at any time.
To delete your account and all associated data, email us at privacy@snapreceipt.dev and we'll remove it.

We'd rather under-promise in a blog post and over-deliver in the product than the reverse. If you want a deletion confirmed, email the same address and ask.

What we don't do

Again, staying strictly within what the published privacy note states:

We don't sell your data. Not receipt images, not extracted data, not analytics.
We don't use your receipts to train models. Your documents are inputs to extraction, not training data.
We don't share your data with anyone except the infrastructure providers named in our privacy note, strictly as needed to run the service.

No advertising partnerships, no data broker arrangements, no "anonymized data sharing" carve-outs.

Questions to ask any vendor

Whether you choose SnapReceipt or not, these questions cut through most privacy marketing. Ask them in writing; the specificity of the answer tells you as much as the content.

Where is extraction actually performed? "AI-powered" is not an answer. Which model, whose endpoint, in which region?
Who processes the document, end to end? Ask for the complete list of subprocessors and infrastructure providers that touch the image or its extracted data, including the OCR or document-AI service, which is the one most often omitted from the marketing page.
Which third parties see my clients' data at all? Include analytics and error-tracking vendors in the question, not just storage. A vendor can be careful with your documents and careless with your behavior.
Where are the servers and the database, and is the database reachable from the public internet? Region names and "allowlist-only" are real answers; "the cloud" is not.
Can I delete everything (individual documents and my whole account), and how? You want a self-serve path for documents and a named contact for account deletion.
Do you train models on my documents? Get a plain yes or no, not a sentence with "may" in it.

A vendor that answers these clearly is usually a vendor whose architecture can survive the answers. A vendor that responds with a link to a generic trust page has told you something too.

Closing

SnapReceipt's answer, in one line: your documents live in our encrypted object storage and our Hong Kong database, extraction runs through the proprietary pipeline we built in-house, the named infrastructure providers are listed in our privacy note, and analytics never leaves our own infrastructure. If you want the legally-worded version, read the full privacy note: it's short and written in the same plain language as this post. If you'd rather see the product first, the extraction proof shows the self-checking arithmetic in action, and you can try SnapReceipt knowing exactly where your documents live.

FAQ

Does any third party ever see my receipt images?

Only the infrastructure providers named in our privacy note, strictly as needed to run the service. No document-AI vendor, no analytics vendor, no advertising vendor ever sees your documents or your behavior. We don't use third-party document-AI services like Google Document AI, AWS Textract, or Azure Form Recognizer, and we don't train models on your receipts. The privacy note is the authoritative, complete list, and it's one click away.

Where are SnapReceipt's servers?

The API and worker run on an Alibaba Cloud ECS instance in Hong Kong, behind a TLS-terminating proxy. The PostgreSQL database is in Alibaba Cloud's Hong Kong region as well, with TLS required and allowlist-only network access. Receipt images are held in encrypted object storage; the named provider is listed in our privacy note.

Do you train AI models on my receipts?

No. Our privacy note states plainly that we don't use your receipts to train models. Extraction is a per-request operation, not a data harvest.

What analytics do you run?

Only self-hosted analytics: page views, clicks, scroll depth, and API usage events written to our own database, plus self-hosted session recordings with all typed input masked. No Google Analytics, no PostHog, no ad trackers. IP addresses are stored only as one-way hashes.

How do I delete my data?

Delete individual receipts in the app at any time. For full account deletion (the account and all associated data), email privacy@snapreceipt.dev and we'll remove it.