Controls your auditor will recognize, described without marketing language

Document history, with the actor, the timestamp, the source — user, system or rule — and the old and new value where a field changed. That covers parsing, extraction, rule matches, field edits, routing decisions, approvals, rejections and their comment, successful exports, and the failures and retries in between. The entries that carry a before value are field edits, status changes, restores, allocation edits, role changes, member removals and revoked invitations; an approval or an export has no prior value to record. One honest gap: workspace configuration changes such as approval tiers are not audited yet. The log is append-only: there is no edit or delete path exposed to any role.

Tenant scoping is applied at the query layer, so every read and write is bound to the requesting organization rather than relying on the UI to filter. Multi-entity separation inside an organization is modeled explicitly too, which is what keeps separate owner and joint venture books apart.

Whoever your roles and thresholds say. Roles do not separate editing from approving: an invoice addressed to you is yours to decide whatever your role, and an unaddressed one can be claimed by a Controller Approver or an Admin. The control that separates the two is separation of duties, a workspace setting that is off until an admin turns it on — with it on, the person who edited the invoice's amounts or coding, or who sent it for approval, cannot approve it, and that holds for admins too. Amount tiers decide how many approvals are needed, matched on the extracted total with the lower bound inclusive and the upper bound exclusive. An invoice whose extraction scored below the confidence threshold stops in the review queue for a person before it can be sent for approval at all, whatever its amount — there is no separate escalation that adds an approver.

TLS in transit, and encryption at rest on the database and on object storage using AWS-managed keys. We do not offer customer-managed KMS keys or bring-your-own-key today. Accounting connector OAuth tokens get a second layer — AES-256-GCM in the application, so a database dump alone does not yield a working ledger credential. Inbound SMTP is served by our own mail infrastructure rather than a third-party relay, so raw messages are not passing through an intermediary before we store them.

Enterprise SSO is available on request on Pro and Enterprise — we configure it with you against your identity provider. It is not self-serve, there is no switch in the app, and we are not going to promise a particular protocol or a setup date until we have done it with you. On every plan, access is by individual accounts with role-based permissions, and since every plan has unlimited users, you never have to share a login to save a seat.

A DPA is part of the Enterprise plan. On security questionnaires and third-party audit reports, the honest position is that inletAP is early: we will answer any questionnaire directly and truthfully, and we will tell you plainly which certifications we do not currently hold rather than implying otherwise. Write to us and you will get a straight answer the same week.

Once an invoice is extracted, its attachment fingerprint and a vendor / invoice-number / date / amount comparison run against up to 200 of your most recent invoices from that vendor, going back two years — nine matching rules and six guards — and a match raises a finding on the document. The comparison runs again whenever the invoice is edited. There is no third pass just before export; what the export does is refuse any document still carrying an open top-tier match, which is the one thing in the product that can hold a bill back. Separately, a redelivered inbound message is suppressed at intake on the ingestor's idempotency key, and an uploaded file is de-duplicated on its own hash.

It is a policy hold. A rule can quarantine a document — an unrecognized sender, an attachment type you do not accept — and it stops in place instead of entering the coding pipeline. Quarantined items are a saved view in the inbox so they are reviewed rather than forgotten.

inletAP is operated from Toronto, Canada, and runs on Amazon Web Services in the US East (Ohio) region, so workspace documents, extracted fields and audit records are stored and processed in the United States. Canadian customers should read that as a cross-border transfer: the privacy policy sets out what it means, and we remain accountable for the data under PIPEDA.

Invoice documents, extracted fields and audit records are kept for as long as you have a workspace, because they are your accounting record — there is no automatic purge of them. What you do control is the raw inbound email: the retention window for it is a setting in the app, from 30 days to ten years, and it is 90 days until somebody changes it. Application logs are kept 30 days. Above 90 days, note that object storage expires the original message anyway, and the app says so beside the setting rather than letting you set a window it cannot honor.

Importing properties, units, vendors and entities is open to admins, controllers and AP specialists; an outside viewer cannot start one. The preview is read-only: it parses the file, matches each row against what you already hold and computes the diff, and it changes no record of yours. Only the commit writes, and it writes one audit entry for the run rather than one per row — the actor, the file name, what was imported and the created, updated, skipped and error counts — so three hundred new buildings are traceable to the file and the person who imported them without burying every other decision that day. The row-by-row detail, including the old value beside the new on each field that changed, stays on the import run itself. The uploaded file is held as text on that run while the preview is open, so a column can be re-pointed without uploading again, and it is cleared when you commit the run, when you discard it, and when the preview expires seven days after it was uploaded. A preview cannot be committed once it is seven days old. One limit worth knowing before you import rather than after: there is no undo button. The commit also writes in batches of 100 rows and can save part of a file and stop, which the report states plainly — re-uploading the same file finishes it instead of duplicating it, because an import matches on the same keys every time.

Yes to both, from the app, with no ticket and no plan gate. An admin can build a ZIP of the whole workspace: every table as NDJSON and as CSV, the original invoice files, the audit trail, a manifest, and a coverage report that names anything left out and marks the archive INCOMPLETE if anything was. The download link is live for seven days and you can ask again whenever you like. Any member — including an outside approver who only sees one building — can request a copy of their own data, because that is a right they hold rather than a feature the workspace buys. Deleting the workspace is self-service too: an admin types the workspace name, and there are seven days to cancel before anything is destroyed. Two things survive on purpose and are named on the screen: Stripe billing records, which Canadian tax law requires us to keep for six years, and a record that the deletion happened, kept 24 months so we can prove it to you.