Trust, stated plainly
Expense management security, read-only by design
Expense management security starts with what a tool can do with your money. SpendNotify can see spend on your existing cards and accounts, and it can never move, hold or block a dollar. This page states what that means in practice.
Architecture
We can see spend. We can never move it.
SpendNotify never logs in to your bank and never asks for your banking credentials. Charges reach it only through channels you set up and control: an iPhone Shortcut that sends each Apple Pay payment to your private SpendNotify URL, your bank's transaction emails forwarded to your private SpendNotify address, CSV, OFX or QFX statements you email or upload, and an HTTPS export from your card provider if you choose to add one. Each of these carries transaction data in one direction, into SpendNotify, and nothing else. There is no payment rail in the product: no card issuing, no transfers, no holds, no bill pay. That is not a policy promise that could drift, it is the shape of the system. A compromise of an alerting tool that cannot transact is a data problem, never a money-movement problem, and we chose that trade on purpose.
The same honesty applies in the other direction: SpendNotify is not a bank, not accounting software, and it cannot stop a payment that is already authorized. It compresses the time between "something crossed a line" and "the right person knows" from weeks to moments. How that loop works end to end is on the real-time expense tracking page.
Practices
How data is handled
Encryption in transit
Connections to the site, your private URL and every webhook we send use TLS. Secrets such as your webhook signing secret are stored encrypted, and access to the database is limited to the people who operate the system.
Data minimization
The alerting engine needs transaction metadata: date, amount, merchant, category, and the last digits of the card. It does not need full card numbers, bank logins or documents, so it does not take them. Your private URL and address are unique to your account, only add charges, never open the dashboard, and are rate limited. On this website, the only personal data we store is the account signup itself.
Access controls
Internal access follows least privilege: production data is reachable only by the people who operate the system, over authenticated, logged channels. In the product, plans carry seat limits, the workspace owner signs in with a one-time code sent by email, seats receive alerts without any access to the workspace, and nobody, including us, ever holds a bank login of yours.
The demo runs in your browser
The alert simulator parses and analyzes pasted transactions locally; pasted data never leaves your browser. Only company-profile runs make one optional network call to write a plain-English sentence about a flagged pattern, and the demo works fully without it.
For larger teams
Enterprise controls
These are the commitments of the Enterprise tier, every one of them in place today, and we claim no certifications we do not hold.
- Signed webhook with HMAC
- Charge intake API
- Security questionnaire + DPA
- Invoicing and PO
- Named support contact by email
The Enterprise column on the spend management software pricing page shows how these fit the plans, and the CFO dashboard page covers what the decision maker sees day to day.
Get started
Questions a security review would ask?
Email [email protected] and we will answer plainly, including "not yet" where that is the honest answer.