Security & privacy

A payment history and a list of students and parents are among the most sensitive things an organization keeps. This page says plainly how ePayRecon protects them — and exactly which outside services ever process any of it.

Who processes data for us

We don't share your data with anyone for their own use. A few service providers process it on our instructions so the service can run, and none of them may use it for their own purposes:

• Our hosting provider runs the servers and the database the site lives on, and delivers the few emails we send (invitations and password resets).
• Anthropic, our AI provider — only if your organization has AI matching switched on, and only the limited data described below.
• Google — only if you choose "Sign in with Google": Google tells us your name and confirmed email address. Google receives nothing about your payments or your people.

Nothing else: the pages load no third-party scripts, fonts, analytics or advertising.

What the AI sees — and how to switch it off

AI matching is on by default and can be turned off at any time, in Settings or on the upload screen (an Owner can also choose it when creating the organization). When it is on, it runs automatically after each upload, only for the payments that are still unmatched or uncertain; a notice at the top of the review screen says so until someone dismisses it.

Matching uses Anthropic's Claude Sonnet 5.5; if it is unavailable we automatically use another Claude model under the same privacy terms (Claude Opus 5.5, then Claude Haiku 5.5), and every answer goes through the same checks.

When it runs, only these are sent to Anthropic, in batches:

• the payer names as your bank shows them;
• the memo text, with email addresses removed and every digit masked except amounts, dates and your own account numbers (such as EP-1042) — so bank account, card, phone and confirmation numbers are never sent;
• the list of names to choose from: your people's names, their related payers' names, their group and their account number.

Never sent: emails, phone numbers, school IDs, bank account numbers, or our internal record numbers (each request uses its own short reference numbers). Anthropic processes the data under commercial terms that prohibit using it to train their models. Its answer is only a suggestion: it is checked against your own list. The AI only suggests matches; nothing is assigned until someone on your team approves it. Until then a suggestion counts nowhere — not in balances, statements, reports or receipts — and "Accept all high confidence" leaves AI suggestions out unless you tick "Include AI suggestions". Every approval, edit and rejection records who made it and when, and a rejected suggestion is not proposed again.

When a batch of payments is settled, a Staff member can finalize it: the assignments are locked and the statement totals for the period stop changing, until an Admin or Owner reopens the list with a reason (recorded).

When you import a bank file

The same switch and the same rules cover the import. With AI on:

• Column mapping: when we can't tell what a column holds, the header row and up to 5 sample rows are sent — with the running-balance column removed and account, card, routing and phone numbers taken out — and the answer is shown as "Suggested by AI" for you to confirm. Once confirmed, that bank layout is remembered and never sent again.
• Transaction details: descriptions our parser can't read are sent (redacted the same way) to find the payer, the payment rail (Zelle, ACH, Venmo…), the kind (payment, refund, returned item, fee, transfer, interest), a reference id and what the payer wrote. Each detail shows where it came from and can be edited. Transfers, fees and interest are set aside as "not a payment".
• PDF statements: when the layout can't be read, each page is sent on its own with your name and address, account, card and routing numbers, phone numbers and balances removed; the result is checked against the statement period and the deposit total it prints. Scanned pages and photos are read with text recognition in your own browser first; only the text, redacted the same way, is ever sent — never an image.
• Never sent: full account or card numbers, routing numbers, balances, the account holder's name and address, or your contacts' emails and phone numbers. If an AI call fails, the import carries on without it and says so.

"Read with AI" for a hard-to-read PDF statement sends the statement's text with account and card numbers removed. With AI switched off, ePayRecon never contacts the AI service at all — switching it off also stops a pass that is already queued — and all matching happens on our server.

Encryption

• In transit: HTTPS only, with HTTP Strict Transport Security.
• At rest: payer names, memo text, references, people's names, related payers' names, emails, phone numbers, notes and file names are encrypted in the database with AES-256-GCM. Lookups use keyed hashes, so matching never needs the plain text stored anywhere.
• Uploaded files are encrypted with AES-256-GCM and kept outside the website's public folder. You can have the original deleted as soon as it's imported.
• The key is kept outside the website folder and outside the database, so a copy of the database alone can't be read.
• Bank account numbers are reduced to their last four digits when a file is read; the full number is never stored.

Signing in

• Two-factor sign-in with any authenticator app (TOTP), with one-time recovery codes. An Owner can require it for everyone in the organization.
• Repeated wrong passwords lock the account for 15 minutes; attempts are also limited per network, and every sign-in form has bot checks.
• You're signed out after 30 minutes without activity. Changing your password, or "Sign out everywhere", ends every other session at once.
• Cookies are Secure, HttpOnly and SameSite; every form and action is protected against cross-site requests.

Access inside your organization

• Roles: Owner (everything, including transferring ownership, requiring two-factor sign-in and deleting the organization), Admin (members, settings, and the access and audit logs), Staff (import, match, review, edit people and rules, run and download reports), Viewer (can view everything in the organization, cannot change or export anything — checked on the server for every change and download, not just hidden buttons).
• Every database query is limited to your organization — not just the screens.
• An audit log records every import, assignment and change. Owners and Admins can view and export it.
• The site administrator's console shows counts (how many organizations, users and uploads) — never names, payments or memos.

Contacts and email

• We store the contact details your organization provides (names, emails, phones, an optional address), encrypted at rest, with keyed hashes so the same email is never stored twice.
• They are used only to send your organization's own notices, statements and receipts — from no-reply@epayrecon.com with your organization's name, replies going to your address — and are never shared, sold or sent to the AI.
• Every email has an unsubscribe link; opt-outs and bouncing addresses are kept on a suppression list and are skipped, statements included. Each send is in the access log and in the contact's history; Viewers can't send.

The access log

Owners and Admins of your organization can review a detailed access log (Settings › Access log), beside the audit log of changes.

• What's recorded: every sign-in and sign-out (and failed attempts, lockouts and two-factor changes), every view of a person's record, the payment and review pages, every report run (which report, filters and dates), every export or download (CSV, Excel, PDF, statements and notices, and original bank files downloaded again), every upload, every AI call (how many items — never what they were), and every refused attempt (a role that doesn't allow it, an expired form, a rate limit, a failed bot check).
• With each row: the time, who (their email is stored encrypted), their role, the IP address and its network, the country estimated from it (offline, IP Geolocation by DB-IP; kept in the log only, never shared), the browser, system and kind of device, and counts such as rows exported. Never passwords, codes, bank lines, memo text or names in plain text.
• Support access is visible: each time our site administrator's console looks at your organization's figures, your log shows "ePayRecon support viewed …".
• Alerts: a sign-in from a new device or from a new country, many failed sign-ins, and large exports outside working hours are flagged on the page; Owners and Admins get an email for a new device and for a new country (each can turn either off).
• Tamper-evident: each row carries a hash of the one before it, so changing or removing a row breaks the chain; the app only ever adds rows, and the chain is verified daily.
• Kept for 1 year by default; an Owner can choose 90 days, 1, 3 or 7 years. Deleting your organization deletes its access log too.
• Each user can see their own recent sign-ins and devices under Account, and sign out of all other sessions.

Pages that can't be tampered with

A strict Content Security Policy allows only our own scripts; the app pages run nothing from anywhere else. Spreadsheet exports neutralize anything that could run as a formula.

Deleting and keeping data

• Delete a person, an upload's original file, or a rule at any time.
• An Owner can delete the whole organization from Settings. Access ends at once; for 7 days an Owner can undo it, and then everything — people, payments, rules, uploads and files, the audit log — is purged by a daily job.
• Our hosting provider makes routine automatic server backups that are kept for a limited time (no longer than about a month). Data you delete drops out of those backups as they are replaced. We do not keep any other copies. In those backups the sensitive fields and files stay encrypted.

What we don't claim

We don't hold security certifications and won't pretend otherwise. What's above is what the software does today. If you find a security problem, please tell us — choose "Privacy or security".