Your receipts are nobody else's business
Receipts show where you went, what you bought and who you paid. We treat them that way. Here is how Woody keeps them safe, in plain language.
Signing in
Multi-factor sign-in
Add a second step with an authenticator app or a code sent by email. Available on every plan.
Passwords done properly
Passwords are never stored. We keep a salted PBKDF2-SHA256 hash with hundreds of thousands of iterations, so a stolen copy is not a list of passwords.
Guessing gets you nowhere
Every sign-in attempt is counted. Too many failures and the account is locked for a while, which makes password guessing impractical.
Keeping data where it belongs
Organizations are walled off
Each organization's data is isolated inside the database itself with row-level security, not just by the app. Inside an organization, people see their own receipts and reports; approvers see the reports sent to them; admins see the organization.
Private receipt storage
Receipt images and PDFs live in a private, encrypted Amazon Web Services storage bucket. There are no public links: every file is checked against your permissions each time it is opened.
An audit trail for money
Approvals, amounts, settings, team membership and accounting connections are recorded when they change, with who did it and when.
Email-in with a gatekeeper
Mail sent to your woody.email address from an address we don't recognize waits for you to confirm it is yours before anything is imported.
Under the hood
- HTTPS only, with HTTP Strict Transport Security
- Hosted on Amazon Web Services in the United States
- Uploaded files are checked by their actual contents, not their name
- Accounting connection credentials are encrypted before they are stored
- Content security policies and anti-forgery checks in the app
- No advertising, no third-party trackers, no selling your data
Found a problem?
If you believe you have found a security issue in Woody, please email [email protected] with the details. We read every report and will reply.
For how we handle personal data, see our Privacy Policy and GDPR statement.