Security at Reimgo: how your expense data is protected
Each company has its own database, bank details are encrypted and every important action is recorded. This page explains the controls in plain words, and where Reimgo is hosted and what it does and does not yet hold, so your team can assess it.
7-day free trial. No card needed. Cancel anytime.
Controls in the product
One database per company
Each customer company has its own PostgreSQL database. Your data is never in the same tables as another customer's.
The company comes from the sign-in
Which company a request belongs to is read from the signed sign-in token, never from a company id in the request. A request without a company is refused.
Permissions on every request
Every protected API route checks the caller's role. The screen hides what a role lacks; the server enforces it.
Two-factor sign-in
Admins and finance must set up an authenticator app. Releasing a payment batch asks for a fresh code.
Segregation of duties
Self-approval is off unless a company allows it for when nobody else can approve. By default a second person releases a payment batch, and nobody can release a batch that pays them.
Append-only audit trail
Changes, approvals, releases, downloads, bank-detail reveals and sign-ins are recorded with the actor, channel and IP address. Entries cannot be edited or deleted.
How data is protected
In transit
All traffic to reimgo.com and app.reimgo.com uses HTTPS with certificates renewed automatically.
Bank details
Account numbers are encrypted with AES-256-GCM under a key per company, which is itself encrypted. Screens show the last four digits. Revealing a full number is a permission and an audit entry.
Payment files
Payroll files are encrypted at rest and fingerprinted with SHA-256 when they are released. A second download needs a reason.
Passwords and codes
Passwords are stored as salted hashes. Two-factor secrets are encrypted. Sign-up codes expire, wrong guesses are limited, and repeated failed sign-ins lock the account for a while.
Backups
The databases are backed up every night, and backups are kept for 14 days.
Receipt reading
Receipt images are sent to our AI provider to be read and are treated as data, never as instructions. Reimgo adds no employee names, bank details or salaries to that request.
AI assistants. Connecting an AI app such as Claude is read-only and off by default: an admin switches it on, each person allows the app on a Reimgo screen, the app sees only what that person's role can see, people appear as person_1, person_2, and every tool call is recorded in the audit trail. AI assistants.
Hosting, compliance and testing
Here is where Reimgo stands today, stated plainly, so your team can assess it against its own requirements.
Hosting
Reimgo runs on Amazon Web Services in the United States. The databases and their nightly backups are kept there, and choosing another region is not available yet.
Certifications
Reimgo does not yet hold SOC 2, ISO 27001 or similar certifications. The controls on this page describe what Reimgo does today.
Availability
The service is monitored. Reimgo does not yet publish an uptime figure or offer a service-level agreement.
Independent testing
A third-party penetration test report is not available yet.
Our privacy policy, terms of service and data processing agreement set out how data is handled.
Questions about security
Where is our data hosted?
In the United States, on Amazon Web Services. The databases and their nightly backups are kept there.
Does Reimgo have SOC 2 or ISO 27001 certification?
Not yet. The controls described on this page are what Reimgo does today, and your team can assess them against its own requirements.
Is there an uptime guarantee?
Not yet. The service is monitored, but Reimgo does not publish an uptime figure or offer a service-level agreement today.
Who can see our bank details?
Only finance users, one account at a time, and each reveal is written to the audit trail. Everyone else sees the last four digits.
Can we export everything if we leave?
Yes. Reports, lines and the reports register export to CSV and Excel, and reports to PDF, including after a subscription ends.
Do you use our data to train AI?
No. Reimgo does not use customer data to train AI models. Receipt images are sent to our AI provider only to extract fields.
How do we report a security issue?
Tell the team through your account. There is no separate disclosure address yet.
Stop re-keying expense reports next month
Set up in minutes. Invite your team, approve a report, prepare the payroll file.