AES-256
Customer data is encrypted at rest using industry-standard AES-256
Security and data privacy
Protecting the data behind every transaction
Your financial data is encrypted, access is limited to what ClearSpend needs, and connected accounts remain under your control.
Last reviewed September 2026
Core controls
Security at a glance
TLS 1.2+
Data in transit is protected with TLS 1.2 or higher encryption
Scoped access
Only the permissions required for each workflow
No AI training
Customer data isn't used to train general AI models
Least privilege
Internal access is restricted
Customer controlled
Connections can be revoked when customers choose
Review materials
Security & privacy resources
Start with the policies and documentation behind ClearSpend AI's security and data-handling practices.
Privacy Policy
How personal and financial data is collected, processed, transferred, retained, and deleted.
Terms & Conditions
Customer data ownership, third-party processing, safeguards, and termination terms.
Integration Documentation
Setup, permissions, and connection behaviour.
Security Review
Request current security, privacy, compliance, or procurement information.
Integration permissions
Exactly what ClearSpend can access
ClearSpend requests only the permissions required for the workflows you enable.
Gmail
Finding billing messages and collecting invoice or receipt attachments for matching.
ClearSpend can
- Read billing messages that match the collection criteria
- Collect invoice and receipt attachments for transaction matching
ClearSpend cannot
- Send Gmail messages
- Edit Gmail messages
- Delete Gmail messages
Connection type
Read-only OAuth access for relevant billing messages and attachments.
Google Drive
Collecting supported invoices and receipts from locations a customer connects.
ClearSpend can
- Read supported financial documents in the selected folder and its subfolders
- Use those documents for matching and reconciliation
ClearSpend cannot
- Edit Google Drive files
- Delete Google Drive files
- Access unrelated locations outside the connected workflow
Connection type
Read-only OAuth access to supported files in selected locations.
Plaid
Retrieving supported transaction information for matching and reconciliation.
ClearSpend can
- Retrieve transaction information such as merchant, amount, and date
- Receive an encrypted read-only access token from Plaid
ClearSpend cannot
- Receive banking passwords
- Store full card or account numbers
- Initiate payments or transfers
Connection type
Read-only transaction access authenticated through Plaid and the financial institution.
Xero
Sending reviewed charges and their matched invoices from ClearSpend to Xero.
ClearSpend can
- Send charges a user marks ready to sync
- Include matched invoices with those charges
- Update the sync status shown in ClearSpend
ClearSpend cannot
- Receive the user's Xero password
- Edit books automatically in the background
- Sync charges until a user chooses Sync to Xero
Connection type
Scoped write access for a user-initiated, one-way sync from ClearSpend to Xero.
QuickBooks
Supporting transaction reconciliation and returning completed records to QuickBooks.
ClearSpend can
- Bring in accounting information required for the connected workflow
- Match transactions with invoices and receipts
- Return reviewed, completed records within the supported workflow
ClearSpend cannot
- Receive the user's QuickBooks password
- Access data outside the permissions approved during connection
- Perform actions beyond the scopes granted to the integration
Connection type
Scoped accounting access approved during the QuickBooks connection flow.Data handling
How ClearSpend handles your data
Four principles limit how customer information is collected, processed, accessed, and retained.
Collect only what is needed
ClearSpend processes information required for the workflows customers enable.
Minimize processing
Only information required for the requested task is processed.
Restrict access
Customer information is available only to authorized people and systems that require it.
Retain only as required
Customer information is retained and deleted according to documented policies and applicable requirements.
AI & customer data
Your financial data isn't AI training data
AI helps ClearSpend extract and structure information from invoices, receipts, and other financial documents. Your customer data does not become general AI training data.
Request subprocessor informationNo training on customer data
ClearSpend does not use personal, financial, or Google user data to train its own or third-party general AI models.
Minimum necessary processing
When an AI provider is required for a supported workflow, only the information required for that task is processed.
Controlled providers
AI subprocessors handle customer information according to ClearSpend's applicable contractual data-processing requirements.
Operational security
Security beyond data access
Only currently verified operational practices are included here.
Security testing
Regular vulnerability scans and internal security assessments help identify potential security issues.
Access management
Internal access is restricted to authorized people and systems that require it.
Data lifecycle
From connection to deletion, you stay in control
Connect
An authorized user approves the integration and requested permissions.
Process
ClearSpend processes the information required for the enabled workflow.
Protect
Information is encrypted and access is restricted during extraction, matching, and reconciliation.
Revoke or delete
Customers can disconnect integrations, revoke future access, and use available deletion controls.
Disconnecting an integration stops future access. Existing data is handled according to ClearSpend AI's Privacy Policy and applicable retention requirements.
Subprocessors
The providers behind ClearSpend
ClearSpend works with selected providers for infrastructure, authentication, integrations, AI processing, and supporting services.
Request subprocessor informationAssurance
Privacy, compliance & assurance
Privacy
Documented privacy practices
The Privacy Policy explains how personal data is collected, processed, transferred, retained, and deleted.
View Privacy PolicySOC 2
Current public status
ClearSpend does not currently represent itself as SOC 2 certified. Contact our team for the latest status of our compliance program and available security-review materials.
Request security informationEnterprise FAQ
Security FAQ
No. Gmail access is read-only and limited to relevant billing messages and attachments for the enabled workflow.
ClearSpend processes supported documents from connected locations. It cannot edit or delete Drive files or access unrelated locations outside the workflow.
No. Plaid provides read-only transaction information. ClearSpend cannot initiate payments or transfers.
ClearSpend can send user-approved charges and matched invoices. Nothing is pushed until a user chooses Sync to Xero.
ClearSpend can return reviewed, completed records within the supported reconciliation workflow. Actions remain limited to approved scopes.
No. ClearSpend does not use personal, financial, or Google user data to train its own or third-party general AI models.
Access is restricted to authorized people and systems that require it. Google user data has additional restrictions described in the Privacy Policy.
Personal data may be processed in the United States or other countries where ClearSpend or its subprocessors operate. Required EEA and UK transfers use recognized safeguards.
ClearSpend uses selected providers for infrastructure, authentication, integrations, AI processing, and supporting services. Request current subprocessor information for a review.
Disconnecting stops future access and synchronization. Existing data is handled under the Privacy Policy and applicable retention requirements.
Customers can use available product controls, close the account, or submit a verified deletion request.
Personal data is kept while an account is active or when required for legal or audit purposes. Verified erasure requests are completed within 90 days under the Privacy Policy.
A DPA is not currently published on this page. Contact ClearSpend to ask about current availability and procurement materials.
ClearSpend does not currently represent itself as SOC 2 certified. Contact the team for current compliance-program status and available review materials.
Request current information about integration permissions, privacy, subprocessors, retention, and the compliance program.
Use the Contact Us route and provide enough context for investigation without sending unnecessary sensitive data.
Found a security or privacy issue?
If you believe you've identified a security vulnerability or privacy concern, contact ClearSpend so the issue can be investigated.
Enterprise security review
Reviewing ClearSpend for your organization?
Security, IT, legal, and procurement teams can request details on permissions, data handling, privacy, and compliance