What SendSure stores, and where

SendSure runs on Arc testnet: the USDC is test money with no value. It is open source, so everything below can be checked in the database schema.

On Arc (public, permanent)

• Your org: its contract, owner, approvers, budget limits and treasury address.
• Each payee's payout address, bound to a random invite id. No names, emails or invoice numbers go on-chain: invoices appear only as a salted hash.
• Each payment, refusal, escalation and co-sign, with the hash of the agent's decision.

In your browser only

• Payee names and emails you type in /org. They never reach our server.
• Payout files you check in /check: the check runs entirely in your browser; the file is never uploaded (only an anonymous count that a check ran).

On our server (Cloudflare D1)

• Claims payees signed: payout address, amount, invoice number, work period, the description they wrote, signature.
• Invoices you ask SendSure to read: the fields read from them, each with the words it came from (these can include the issuer's name). The invoice text or photo itself is not kept.
• Bills your Odoo sends: bill number, amount, date and line descriptions.
• The agent's decision log (what it checked and why), which anyone with the org can replay.
• A secret salt per org (so invoice numbers stay private on-chain), and integration keys as hashes only.
• No accounts or passwords: you sign in by signing a message with your wallet.
• If you fill in “Get set up”: what you typed there (team, how to reach you, how you pay, your next payout), to contact you about setting it up. Nothing else.
• If your org turns on notifications: the Discord or Slack webhook URL you gave, to post your notices there.
• Anonymous counts: that a payout check ran, an invite link was opened, a walkthrough started or a ledger was downloaded, per day. No addresses, amounts, files or anything that identifies you.

Sent to an AI model

Invoices you ask SendSure to read, and the claims the agent reviews (invoice number, amount, period, description, the contract's check), go to Claude through Anthropic's API. The model can only hold or escalate a payment; it can never make one happen. If you ask the agent to review a payout run on /check, that list (names, addresses, amounts, references) goes to SendSure and Claude for that review only; SendSure keeps only anonymous counts.

Removing your data

Anything on our server can be deleted on request: ask us. What is on Arc cannot be removed by anyone, which is why it holds no names.