Security built for the most sensitive data finance owns
Read-only connectors, card numbers masked before storage and zero model training on receipts. Audited annually under SOC 2 Type II and ISO 27001.
folio_88214.pdf, ingestion
- merchantThe Lakeshore Grand, Chicagokept
- guest_nameemp_7f3a91 (Deepak F.)pseudonymized
- card_number**** **** **** 6621masked
- card_expiry[removed]removed
- guest_phone+1 *** *** 0147masked
- home_address[removed]removed
- line_items7 lines, $984.73kept
Masking runs before anything is written to disk or sent to a model. Full card numbers never reach storage, logs or the drafting service.
- Type II, zero exceptions
SOC 2
Type II, zero exceptions
- 2022 certified
ISO 27001
2022 certified
- Encryption at rest
AES-256
Encryption at rest
- Encryption in transit
TLS 1.2+
Encryption in transit
- US East and Mumbai
2 regions
US East and Mumbai
- Third-party pen tests
2x yearly
Third-party pen tests
Architecture
Follow a receipt through Phyto Nex AI
Select any stage to see what data it holds, how it is protected, where it lives and how long it is kept.
Selected stage
Masking
- Data at this stage
- Card numbers cut to last 4, expiry and CVV dropped, contact details pseudonymized
- Protection
- Luhn-validated PAN detection plus pattern rules. Unmasked values never written.
- Region
- Pinned: US East or Mumbai
- Retention
- Ephemeral
Controls that protect employee and card data
Nine commitments written into our security policy and tested by independent auditors.
Read-only API integrations
Connectors request the narrowest scopes each vendor offers. Phyto Nex AI cannot approve, pay, refund, deduct or cancel anything in your expense platform, card program or ERP unless you enable ERP write-back for approved outcomes.
Zero model training
Customer receipts, employee names and financial data are never used to train foundation models. Drafting runs through Anthropic, PBC under zero data retention and no-training terms, with masked inputs only.
PAN and PII masking
Primary Account Numbers are cut to the last four digits at ingestion; expiry dates and CVVs are dropped. Phone numbers, home addresses and personal emails on folios are redacted or pseudonymized before storage.
Encryption everywhere
AES-256 at rest with AWS KMS, per-tenant data keys for Enterprise, and TLS 1.2 or higher in transit with HSTS. Database backups and receipt images are encrypted with separate keys.
US and India data residency
Choose AWS US East (N. Virginia) or Asia Pacific (Mumbai) at onboarding. Receipt images, line items, findings and audit logs stay in that region.
SSO and SCIM
SAML 2.0 and OIDC single sign-on with Okta, Microsoft Entra ID and Google Workspace. SCIM 2.0 provisioning removes access the moment someone leaves.
Role-based access control
Separate roles for AP reviewers, approvers, controllers, auditors and admins. External auditors get read-only, time-boxed access to findings without employee contact details.
Immutable audit logs
Every flag, edit, approval, message and export is recorded with actor, timestamp and before and after values. Logs are retained for 7 years and exportable to your SIEM.
Data retention you control
Receipt images default to 13 months and can be set from 90 days to 7 years. On termination, customer data is deleted within 30 days and purged from backups within 35.
What our connectors can and cannot do
We publish the scopes we request so your security team can verify them against each vendor's documentation.
| Connector | Reads | Can never |
|---|---|---|
| SAP Concur | Expense reports, entries, receipt images, approval workflow | Approve, send back or pay reports |
| Ramp | Transactions, receipts, memos, users, spend programs | Lock cards, change limits, move funds |
| Brex | Card transactions, reimbursements, receipts, policies | Freeze cards, issue payments |
| Expensify | Reports, SmartScan receipts, policy categories | Reimburse or reject reports |
| Navan | Trips, bookings, folios, expense items | Book, change or cancel travel |
| NetSuite | Vendors, GL accounts, departments | Write anything unless write-back is enabled by an admin |
“Our vendor review took one call. The SOC 2 Type II report was clean, the scopes were read-only as documented, and they showed us in writing that our receipts never train a model. Complete data segregation was the deciding factor.”
Elena Vasquez
VP Information Security, a 1,200-employee global consulting firm
Security questions
Report a vulnerability to security@phytonexai.com. Live component health is on the status page.
No. Connectors are read-only and Phyto Nex AI has no ability to approve, reject, pay or freeze anything. It flags findings and drafts messages. Your AP team approves every outgoing message and decides every deduction.
Never. Customer data is excluded from all model training, ours and our providers'. The drafting model receives a masked finding and the policy clause, runs under zero data retention terms and returns text that AP reviews.
In the region you choose at onboarding: AWS US East (N. Virginia) or AWS Asia Pacific (Mumbai). Support staff access is logged, time-boxed and requires approval from the customer's admin for anything beyond metadata.
Yes. Request it from the trust center. We share it under a mutual NDA, usually within one business day, along with our most recent penetration test summary and CAIQ.
We follow a documented incident response plan with 24/7 on-call coverage. Confirmed incidents affecting customer data are reported to the customer's security contact without undue delay and within 48 hours, with a written postmortem.
Yes. Most questions are answered by our CAIQ and SOC 2 report. For anything else, email security@phytonexai.com and our security team responds within one business day.
Stop playing expense police. Put policy enforcement on autopilot.
Connect Phyto Nex AI to your expense tool in 15 minutes and see what slipped past managers this month.
14-day free production trial. Read-only connectors. No card required.