Reconciliation data stays in the browser

Every file you load, every matched or unmatched row, every treatment note and every export is produced on the analyst's own machine. RecFlow's servers never receive a transaction, an account number or a balance. Large packs are parsed in a background worker inside the browser. If you close the tab, the last run is restored from that browser's own storage, not from us.

What our servers hold

• Your sign-in (email, name, password hash held by Firebase Authentication, or your Google identity).
• Your workspace: institution name, members and roles, plan, trial and subscription state.
• Billing records: invoices, the payment provider's references, webhook receipts. Card numbers are handled by Flutterwave or Stripe and never reach us.
• Usage counts: how many runs a workspace made in a month and how many rows and exceptions they involved, as numbers only, for capacity planning and support.
• An audit trail of account and billing actions.

Controls

• Firestore rules deny all browser access; only the control-plane service writes, so a plan change or suspension takes effect on the next request.
• Transport is TLS everywhere. Payment webhooks are verified by signature before anything is recorded.
• Account numbers can be masked in tables and exports (Settings › Governance). Auto sign-out after inactivity is configurable.
• Roles: owner, admin, analyst, viewer. Enterprise tenants can use SSO through their own identity provider.
• Infrastructure runs on Google Cloud (Firebase Hosting, Cloud Run, Firestore in the European multi-region) with budgets and alerts in place.

Nigeria Data Protection

Korevra Technologies Limited processes personal data under the Nigeria Data Protection Act 2023 and the NDPR. Because reconciliation data does not leave your systems, RecFlow acts as a processor only for the account and billing data listed above. Our data processing summary sets out the terms; a signed DPA is included with Enterprise.

Reporting a concern

Write to support@korevra.com with "security" in the subject. We acknowledge within one business day.