Barespend's Security Details

Last updated: October 2026.

Introduction

As a company that handles receipts and financial transaction data, we recognize the importance of excellent security practices. While we are a small team, we work hard to punch above our weight on security.

This document covers our security practices and policies. If you are interested in the data we collect and store, please see our privacy policy.

General practices

• Access to servers, source code, and third-party tools are secured with two-factor auth.
• We use strong, randomly-generated passwords that are never re-used.
• Employees and contractors are given the lowest level of access that allows them to get their work done. This rarely includes access to production systems or data.
• We use automatic security vulnerability detection tools to alert us when our dependencies have known security issues. We are aggressive about applying patches and deploying quickly.
• We don't copy production data to external devices (like personal laptops).

Access control and organizational security

Personnel

Our employees and contractors sign an NDA before gaining access to sensitive information.

Penetration testing

We had a penetration test performed in September of 2021. The assessment concluded that "Overall, the security posture of the Barespend platform was found to be in line with industry best practices." If you'd like a full copy of the results, send us an email.

Authentication

Users sign in to the Barespend web app with their email and password. Passwords are salted and hashed before they are stored, and are never kept in readable form.

When a user signs in, the app issues a bearer token that expires after 6 hours. Every further request to our API includes this token in an Authorization header.

Encryption

All communication between your browser and the Barespend app, API and website is encrypted in transit with TLS 1.2 or higher.

Customer data is stored in Azure SQL Database, which encrypts data at rest using transparent data encryption. Receipts and other files are kept in Azure Blob Storage, which also encrypts data at rest.

Data retention/logging

Application and server logs are kept within our Azure environment.

These logs are retained for 30 days, after which they are permanently deleted.

Application analytics can be permanently deleted on request.

Software development practices

• Code written by any developer is signed off by at least one other person before committing.
• Code is tested in a staging environment against a QA checklist before deploying to production.

Vulnerability detection

Both the frontend client and our backend are regularly scanned for dependencies with known security vulnerabilities.

Vulnerable dependencies are patched and redeployed rapidly.

Hosting

Barespend runs on Microsoft Azure. The web app and API are hosted on Azure App Service, customer data lives in Azure SQL Database and Azure Blob Storage, and this website and our sign-up site are served from Azure Static Web Apps. Receipts are read automatically with Azure AI Document Intelligence.

Microsoft's data centers hold independent attestations and certifications, including:

• ISO/IEC 27001
• SOC 1, SOC 2 and SOC 3
• PCI DSS

These apply to Microsoft's infrastructure, not to Barespend itself. See Microsoft's compliance documentation for the current list and reports.

FAQs

What user data do you collect?

We're not in the business of making money off of data. We do collect information about how people use our website and app so we can improve the product and provide faster, more effective support when issues arise. This includes:

• Pages viewed, clicks and scrolling on our website and in the web app
• Session recordings in the web app, where what you type into input fields is masked
• Crashes and other errors
• Browser, device type and approximate location, as reported by standard web analytics tools

We use Google Analytics on our website and Microsoft Clarity on our website and in the web app. Our privacy policy explains what they collect and how to opt out.

Users are identified in our system by their email address and are asked to provide a name. We don't attempt to collect demographic information.

How do I report a potential vulnerability or security concern?

We are continually engaged with a team of researchers in a private bug bounty program and therefore do not provide compensation for independent reports. However, if you have a concern please email us at support@barespend.com, which will notify us very loudly and we'll get back to you ASAP.

Are you SOC 2 or ISO 27001 certified?

While we'd eventually love to achieve these certifications, we don't hold them at this time. Our hosting provider, Microsoft Azure, does hold them for its infrastructure.

Any further questions?

Great! Please email us and we'll happily update this doc.