Security & Compliance

• Canadian hosting

  In place

  Production databases, stored documents, backups, and infrastructure logs are hosted in AWS Canada Central, Montréal.

• Encryption

  In place

  Encryption is enabled for stored production data and supported connections to the service.

• Customer separation

  In place

  Database controls separate each customer company’s information.

• Access controls

  In place

  User roles, session controls, and logged support access are implemented.

• Monitoring and backups

  In place

  Cloud monitoring, security alerts, audit logging, and automated database backups are implemented.

• Independent assurance

  Not yet

  No independent penetration test or security audit has been completed.

• SOC 2 and ISO 27001

  Not yet

  RavenTrack does not currently have a SOC 2 report or ISO 27001 certification.

• Privacy compliance program

  In progress

  Internal assessment completed; outstanding policies, procedures, training, and vendor reviews remain in progress.

• Cloud administrator MFA

  In progress

  Multi-factor authentication was not yet enforced across cloud administrator accounts at the assessment date. Implementation is an identified priority.

• Retention and deletion

  In progress

  Team assistance is required. Automated deletion and a complete retention schedule are not yet implemented.

Certifications or audit reports held by our infrastructure providers do not certify RavenTrack itself.

Encryption and infrastructure

RavenTrack uses HTTPS with TLS 1.2 or later to protect connections to the service. Production databases, document storage, backups, logs, and stored credentials use encryption at rest through AWS encryption services.

Production databases are located within private networks, and public access to customer document storage is blocked. Integration credentials and service secrets are managed through AWS Secrets Manager.

Encryption helps protect information, but no online service can guarantee absolute security.

Customer separation and permissions

RavenTrack uses company identifiers and database-level access controls to help prevent one customer company from accessing another company’s records.

Customer administrators manage invitations and user roles. Permissions determine which information and functions users can access. Additional database-level restrictions for project-manager access remain under testing.

Passwords are stored using salted, one-way hashing. Sign-in protections include expiring email codes, limits on failed attempts, and session revocation.

Support access

RavenTrack’s support “view as” function is read-only, requires a reason, expires automatically, and records the access in audit logs.

Engineering personnel also require privileged infrastructure access to operate and maintain the service. Formal access-review procedures and administrator authentication improvements remain part of our outstanding security work.

Canadian hosting does not mean all processing stays in Canada.

Our production databases, stored receipts and invoices, backups, and infrastructure logs are hosted in Montréal. Certain service providers process information outside Canada.

• AWS hosting and storage

  Purpose

  Operate the platform and store production information

  Processing location

  Canada

• Amazon Textract

  Purpose

  Extract text from receipts and invoices

  Processing location

  Canada

• OpenAI API

  Purpose

  Interpret receipt images and extracted text; assist with product identification

  Processing location

  United States

• Amazon Bedrock using Anthropic models

  Purpose

  Suggest expense cost codes

  Processing location

  Canada or the United States, depending on routing

• Customer-authorized integrations

  Purpose

  Exchange information with connected business systems

  Processing location

  Subject to the connected provider’s arrangements

Information processed outside Canada may be subject to the laws and lawful access requirements of the relevant jurisdiction.

Other services support functions such as mobile updates, fonts, domain services, and business communications. Verification of some provider metadata, retention practices, and processing locations remains in progress.

RavenTrack uses AI to extract information and suggest how expenses should be organized. AI can misread documents, omit information, or suggest an incorrect category or project.

Customers should review financial information and remain responsible for their accounting records. Posting permissions and any automation must follow the workflow authorized for the customer’s account.

RavenTrack does not train or fine-tune AI models using customer data.

Our providers’ handling of information depends on their applicable terms, services, and account settings.

Our assessment identified an outstanding action to apply and verify AWS’s AI-services opt-out for Textract. Until that is confirmed, we cannot make a blanket promise that every AI provider excludes submitted information from service improvement.

Disabling optional provider storage does not necessarily eliminate all provider retention, including retention for abuse monitoring or legal requirements.

RavenTrack does not sell customer information or use it for advertising.

RavenTrack maintains application audit trails for activities including sign-ins, edits, approvals, accounting postings, user changes, and support access. Cloud monitoring and automated alerts help identify operational problems and potential threats.

Changes pass through automated checks, including tests of customer separation. Container images are scanned for vulnerabilities.

Automated tests use synthetic data. Existing pilot data is also present in a separate Canadian staging environment. Written authorization, minimization, and retention rules for test-data use are being formalized.

Automated production database backups support point-in-time recovery over the preceding 14 days. Other document versions, logs, and release snapshots have different retention periods.

RavenTrack does not currently provide a standard uptime guarantee. Production infrastructure does not yet include automatic failover across availability zones or regions. Customers should retain their original financial documents and required accounting records.

Customer records are generally retained while an account is active. Export, account closure, and deletion requests currently require assistance from our team.

A complete retention schedule and standardized deletion procedures are still being finalized. We do not currently promise immediate removal of all copies or a universal deletion period.

Backups, document versions, audit records, and legally required records may remain after information is removed from the live service. Some security logs and release snapshots do not yet have fixed deletion periods.

Applicable privacy rights and legal deadlines continue to apply.

Security alerts are available to the technical team. Our written incident-response procedure and breach-recordkeeping process have been drafted but are not yet fully adopted.

Where an incident triggers notification or reporting obligations, RavenTrack must meet the applicable legal requirements and any additional commitments in the customer’s agreement. This page does not establish a universal 72-hour notification period.

Our internal privacy assessment uses Canada’s PIPEDA principles to identify gaps and guide improvements. It is a self-assessment, not regulatory approval or an independent finding of compliance.

Outstanding work includes:

• Adopting privacy, access-request, complaints, and incident-response procedures.
• Completing staff privacy and security training.
• Finalizing retention, deletion, and test-data rules.
• Completing vendor-contract and security-assurance reviews.
• Enforcing cloud administrator MFA.
• Arranging independent security testing.

Applicable Canadian provincial and United States requirements must also be assessed for the customers and information involved. We do not claim blanket compliance with every privacy law or security standard.

For security concerns, privacy requests, or questions about this page, contact Peyman Moeini at peyman@raventrack.ai.

Please describe the concern without including passwords, access tokens, or unnecessary sensitive information.

This page summarizes our documented practices and current limitations. Contractual commitments are set out in the applicable customer agreement. Nothing on this page limits rights or obligations under applicable law.