Security and data

Where your receipts live, who can see them, and how they're protected.

Who can see what

• Business owners see their own business's receipts, team and claims.
• Staff send receipts and claims on WhatsApp. They don't get a dashboard and can't see other people's receipts.
• Accountants and bookkeepers see only the businesses linked to their practice – and a practice can limit each bookkeeper to the clients they look after.

Signing in

Dashboards open only after a one-time six-digit code sent to your WhatsApp number. Codes expire after 10 minutes and are locked after five wrong tries; we store them only as one-way hashes. A sign-in stays active on that browser while you use it and ends after 30 days without a visit. You can see and sign out your browsers from the dashboard, or send sign out everywhere on WhatsApp to end them all – for example after losing a phone.

Where data is stored

Live data and documents are hosted by Railway in the United States. Nightly backups go to Cloudflare R2 in its Western European region, where data is encrypted at rest. Database backups are kept for 30 days. All traffic to the website and dashboards is encrypted in transit (HTTPS).

Who processes data for us

• Meta – the WhatsApp Business Platform, to send and receive messages.
• Anthropic – to read the details on a document and understand messages. Anthropic doesn't use this data to train its models.
• Railway – hosting and storage.
• Cloudflare – domain, email routing and backups.
• Resend – sends Pennies emails and receives supplier emails forwarded to a Pennies address (Western Europe).

Privacy law

We follow South Africa's Protection of Personal Information Act (POPIA). People in the UK and EU have the same rights to see, correct and delete their information under the UK and EU GDPR. The privacy policy has the detail. Our information officer can be reached at hello@penniesapp.com.

If something goes wrong

If personal information is accessed without permission, we tell the people affected and the Information Regulator as POPIA requires, with what happened and what we're doing about it.

Deleting your data

Ask at hello@penniesapp.com. Receipts can also be deleted from the dashboard or with delete on WhatsApp.

Report a security issue

Email hello@penniesapp.com with "Security" in the subject. We reply within two working days.