Workspace isolation
Every document, document type, key and setting belongs to one workspace. Logins and API keys can only reach their own workspace.
Security
Built to handle financial documents
Invoices, bank statements and purchase orders are sensitive. Here is how PW protects them.
01Access
Only the right people see each document
Roles
Owners and admins manage settings, people, keys and webhooks; members work with documents. API keys cannot change workspace settings.
Credentials stored as hashes
Passwords are hashed with Argon2. API keys are stored as SHA-256 hashes, shown only once when created, and can be revoked at any time.
Controlled email intake
Inbox addresses contain a random key, and an optional sender allowlist accepts email only from addresses or domains you list.
02Data in motion
Protected between systems
Encrypted connections
The website, dashboard and API are served over HTTPS so documents and data are encrypted in transit.
Short-lived file links
Original files are never public. Viewing one creates a signed link that expires after 15 minutes.
Signed webhooks
Every webhook carries an HMAC-SHA256 signature so your system can confirm it came from us. Webhook targets on private networks are blocked.
03Data at rest
Where your data lives and for how long
Data location
Documents and data are hosted in India (Mumbai).
Retention and deletion
Files and extracted data are kept while your account is active and deleted on request or when you delete them.
AI processing
Text-only mode reads documents on our own servers. AI extraction sends the document to our AI model provider to extract the fields. Corrections you make are kept as examples inside your workspace only and are never used for other customers.
Checks before delivery
Business-rule checks and a review queue stop doubtful data from flowing into your systems automatically.
Found a security issue?
Please report it privately to info@peczaweb.com. Include the steps to reproduce it, and give us reasonable time to fix it before sharing it publicly. For questions about data protection, see our privacy policy.