Security and data
This page is for the person who has to sign off on InletAP — a controller, an owner, or whoever in your organization reads security questionnaires. It describes what the product enforces, what it keeps, and what it does not have. The marketing-level summary lives at /security; this is the version with the caveats left in.
Separation between customers
Tenant scoping is applied at the query layer. The organization is taken from your session, never from a parameter in the request, and every read and write is bound to it before it reaches the database.
The distinction matters more than it reads. A product that filters by organization in the interface is one forgotten filter away from showing you somebody else's invoices. A product that binds the organization below the interface cannot answer a question about another workspace at all, however the request is phrased. An identifier belonging to another customer comes back as not found, which is also the honest answer: as far as your session is concerned, it does not exist.
Separation inside your organization
Legal entities are modeled explicitly, not approximated with a naming convention on properties. This is what keeps an owner's books apart from a joint venture's when both run through the same AP queue and the same team.
Roles separate the work rather than ranking the people. Editing an extracted field and approving spend are different permissions, so the person who corrects a total is not automatically the person who authorizes it. See roles and permissions for the matrix, and approval tiers for the amount bands layered on top.
Quarantine
Quarantine is a policy hold. A rule can quarantine a document — an unrecognized sender, an attachment type you do not accept, anything you can express as a rule condition — and the document stops there instead of entering the coding pipeline.
It is deliberately not the same thing as filtered. Filtering is a routine judgment that an email was not an invoice, and it is reversible with one action. Quarantine is an exception someone is expected to look at. Conflating a newsletter with a suspicious attachment would make both harder to reason about, and would train your team to clear the queue without reading it.
Quarantined documents are visible and searchable. Nothing is silently dropped, which is the failure mode that actually costs money in AP: an invoice that vanishes is worse than one that stops somewhere awkward.
Encryption and mail handling
Traffic is encrypted in transit, and stored documents are encrypted at rest with per-environment keys for object storage.
Inbound mail is received by our own mail infrastructure rather than a third-party relay, so raw messages are not sitting with an intermediary before we store them. Accounting-connector credentials are held as ciphertext, never returned by the API and never written to logs; disconnecting a connector revokes the grant at the provider first and then clears the stored tokens.
Retention
| Data | Kept for |
|---|---|
| Invoice documents, extracted fields, coding and audit records | As long as your workspace is active — they are your accounting record |
| Raw inbound email objects | Expired automatically after 90 days |
| Application logs | 30 days |
The 90-day expiry on raw messages is worth understanding rather than skimming. The invoice document, its extracted text, its fields and its whole audit history survive; what ages out is the original MIME envelope in object storage. In practice that means you can always answer "what did this invoice say and who touched it", and after three months you can no longer re-download the exact bytes of the email that carried it.
Per-workspace retention schedules are not configurable today. There is also no self-service workspace deletion: export or deletion happens on written request. If you have a specific retention obligation, tell us what it is and we will confirm in writing whether we can meet it, which is a slower answer than a settings toggle and a more accurate one.
Reliability, since it is a security question in disguise
An AP pipeline that loses a document quietly is a control failure, not an outage. The guarantees that matter here:
- Unrecoverable failures land in a dead-letter queue rather than disappearing.
- Pipelines are idempotent: a retried job cannot produce a second document or a second bill.
- A transient failure at the mail edge returns a temporary error so the sender retries, rather than accepting mail we cannot process.
- Export items record the external identifier they were given, so a retry updates or recognizes the existing record instead of creating another one.
What InletAP does not have
InletAP is an early product and does not hold third-party security certifications. There is no SOC 2 report, and we are not going to describe the position as "SOC 2 ready", because that phrase means nothing and is generally deployed by people who know it means nothing.
Also absent, and worth knowing before you buy:
- No payment rails. InletAP produces approved, coded bills. Money moves wherever it moves today.
- No native property management system connector. CSV export covers Xero, AppFolio, Buildium, Yardi and Rent Manager.
- No per-tenant retention configuration and no self-service deletion, as above.
What we will do is complete any security questionnaire honestly and tell you which controls are implemented and which are planned, without blurring the two. If an audit report is a procurement requirement for you, that is a real reason not to buy yet, and we would rather you found out on this page than in week three.
Where to go next
- Audit trail — the append-only record behind most of the claims above.
- Roles and permissions — separation of duties in detail.
- Invoice statuses — where
quarantinedandfilteredsit in the pipeline. - Plans and limits — allowances, held documents and what is counted.