Security

The details

Your bill file stays on your device

Your own browser reads the file and keeps it in its storage (IndexedDB). A PDF’s printed text is read directly. A photo or a scan, including a scanned PDF whose only text is a hidden layer its scanner added, goes through text recognition that runs on your device. The bill file is never uploaded, and there is no server holding bills, so there is no store of bills to break into.

Nothing about your bill is stored on our side

There is no database. When you ask for the checks, the figures from your bill are checked in memory and the answer is sent back. Nothing is written to disk or kept between requests, and what you send is never logged.

Your name and numbers stay with you

When you ask for the checks, your browser sends what it read: the charges with their descriptions, codes, dates, amounts and billing organizations; the bill’s type, totals, dates, currency and number of pages; the page and line each figure came from, how sure the reading was and notes on it; whether the bill shows a provider, insurer, statement or claim number, not what they say; your answers to the money questions; your country; and, for the full list, your receipt or pass. Before that, it removes your name, address, account and member numbers and date of birth wherever it recognizes them; a name printed with no label (such as a child’s name in a heading), a first name on its own in a charge, or a layout the reader does not know may not be recognized, and the Privacy Policy lists these limits.

An encrypted connection

Every page is served over HTTPS, and browsers are told to use HTTPS only (HSTS, for one year).

Proof of payment without an account

After you pay, your browser keeps a receipt (for one bill) or a pass (for a subscription) signed by our server. A receipt is tied to the exact figures you paid for, so it can’t be reused for another bill. The paid checks need one of them; the free preview needs none.

Your card goes to Stripe, not to us

Checkout happens on Stripe’s page. Your card never reaches our servers, a receipt or pass is issued only after Stripe confirms the payment, and Stripe is the only record of who paid.

Sign-in without passwords

Subscribers sign in on a new device with an emailed link that expires after 15 minutes. The reply is always the same, so it never reveals whether an email belongs to a subscriber. Sign-in links go only to subscribers. Apart from these links, the payment emails Link sends and the email that returns an organization’s plan link to the address its buyer types, we write by email only to answer a request about your rights, confirm a withdrawal or put a payment right, at the address you gave.

Limits on repeated requests

Requests that send an email, sign you in, start a payment or run the checks are limited per visitor, so a burst of requests is slowed down.

Files checked on your device

Files are checked by their actual content, not their name. Only PDF, JPEG, PNG, WebP and HEIC are accepted, with limits on size and number of pages. Because reading happens in your browser, a harmful file can only affect your own session.

Only our own code runs on the page

Our content policy lets pages load scripts from, and connect to, only our own site. It still allows inline scripts, which some of the tests below point out. There are no third-party scripts, no analytics scripts and no trackers.

Bills are read as text, never as instructions

The checks are fixed code, not an AI model, and no document ever reaches an AI provider.

Nothing sensitive in logs

Our functions log a random request number, the method, the path, the status and how long it took, and for a failed request the error code and a short description of the fault, never what was sent. For a successful free check, full list, checkout started or payment confirmed, the line also names that step, so we can count each step in a week. When a free-access link we gave an organization that helps patients is used, they also log that organization’s name, never the code in the link. When a browser opens a page, one count line is also written: the page’s path, whether it is the public site or the app, the country, the referring site’s host name and the day, with the time our host adds when it writes the line. It is kept about 3 months and never holds a network address or anything about a bill. Our host, Cloudflare, also keeps its own record of each request for up to about 7 days, which can include the network address it came from. If a page fails to load, your browser may also send Cloudflare a short error report. If error reports are switched on, request bodies, addresses and headers are removed before anything is sent.

You can erase everything

Settings has one control that deletes everything the app holds in your browser: bills with the corrections and answers kept with them, results, letters, receipts, your pass, your consent and the app pages saved for offline use. We keep nothing about your bills, so nothing of them is left on our side. You can download it all first.