Security
What is true today, and what is not
Documents are private business records, so this page separates what is implemented from what is planned, and states the pilot exception rather than hiding it.
Bobby Receipts is under development. Security architecture and operational controls will be verified before pilot use.
Three honest columns
Implemented, pilot exception, planned
Implemented
- Documents are stored in EU-hosted object storage, private to one workspace.
- Access to a document is decided by the workspace it belongs to and the person's role in it.
- Extraction runs are append-only, so a re-read cannot overwrite what was recorded before.
- Corrections are stored alongside the value they replaced, with who made them.
- Storage residency is verified rather than assumed.
Pilot exception
- Malware scanning is built but disabled during the internal pilot. It is not operating on uploaded documents.
- While it is disabled, each document is disclosed as unscanned. Nothing is presented as having passed a scan.
- Quarantine remains enforced: a document held in quarantine is never opened, read or extracted.
Planned
- Enabling malware scanning for every uploaded document before it is read.
- Customer-managed deletion and export controls beyond the pilot workflow.
- Provider connections requesting the narrowest access that works, and revocable at any time.
- Independent review of the security architecture before any public availability.
These statements describe the current internal pilot. No certification, audit result or regulatory status is claimed anywhere on this site.
How it fits together
A document never leaves its workspace
A document is uploaded into one workspace, stored privately in the EU, read by extraction and presented to a person for review. The evidence trail beside it is append-only, and a quarantined document is never opened.
Design principles
What the product is built to protect
Private by default
Documents are intended to be private to the workspace they were uploaded into, and visible only to the people that workspace includes.
Workspace separation
Separation between workspaces is a design requirement: a personal workspace and a company workspace must never see each other's documents.
Role-based access
The direction is that what a person can see, change and approve follows their role in the workspace.
Controlled approval history
Approval decisions are intended to be recorded as history rather than silently overwritten.
Auditability
Being able to answer 'what happened to this document, and who did it' is a stated product requirement.
Secure provider connections
When mailbox and storage connections are built in later phases, they are intended to request the narrowest access that works, and to be revocable.
Export and deletion controls
Getting your documents out, and having them deleted, are product requirements rather than optional extras.
Data minimization
The intent is to hold what the workflow needs and no more.
Your documents are not a product to sell
Selling the contents of your receipts is not part of the product plan.
Explicit non-claims
What Bobby Receipts does not claim
- No encryption claim is made here, because no storage architecture has been verified yet.
- No certification is claimed: not SOC 2, not ISO 27001, and no audit has taken place.
- No regulatory compliance status is claimed, in any jurisdiction.
- No security testing result is claimed, because none has been performed and published.
- The product is not production-ready and is not offered for real document handling.