What FetchPaperwork can access — and what it can’t.
A passkey check for your FetchPaperwork account
Turn on passkey protection in Settings. After password sign-in, enrolled accounts must verify a passkey with device verification before the workspace unlocks. Challenges are tied to this website and sign-in session and expire after five minutes. Verification lasts up to 12 hours within that session. One-time recovery codes are stored only as hashes; resetting your password does not turn this protection off. API keys have separate, revocable permissions.
A restricted collection worker
The production collection worker runs with a kernel-enforced filesystem allowlist. It can read approved software and credential paths and write to its private working directories. Its child processes inherit these restrictions. This limits what an exploited worker can reach; it does not make a compromised worker safe, remove its ability to decrypt supplier logins, or eliminate trust in the host administrator.
Limited access to our hosting account
The collection worker cannot read our hosting-account login. It uses a verified, expiring credential tied to FetchPaperwork. A separate refresh process renews that credential and cannot read the supplier-password vault key. These restrictions reduce the access available to either process; they do not remove the need to trust the host administrator.
How we protect saved logins
Saved-password connections encrypt supplier usernames and passwords before database storage using AES-256-GCM. Each record uses a fresh encryption key, wrapped with RSA-OAEP, and is bound to your workspace and website. Secure-browser connections do not store the supplier password as a source credential at all. HTTPS protects data in transit.
Who can access your password?
For saved-password connections, our collection worker decrypts your supplier login to sign in and retrieve invoices. Its decryption key is kept separately from the public web service. For secure-browser connections, you type the password into the disposable live browser instead: it can exist briefly in that browser process and transit the hosting infrastructure, but FetchPaperwork does not save it as a source credential. This is not end-to-end or zero-knowledge protection: compromise of a process handling the live sign-in could expose what you enter.
One website per isolated browser
Each collection uses a temporary isolated browser, restricted to the approved website origins. In secure-browser mode it receives no saved supplier-password envelope, database credentials, cloud-storage tokens or vault keys. Browser input is masked in the viewer, request and response caching is disabled, sensitive values are excluded from audit and diagnostic logs, and the browser environment is stopped after the attempt.
MFA and security checks stay in place
We do not bypass MFA or store authenticator seeds. Explicitly opted-in secure-browser workspaces can use CapSolver to recognize supported CAPTCHA image grids; only the cropped grid and object category are sent, never passwords or cookies. Unsupported or unsuccessful checks remain available to complete manually. In saved-password mode, a one-time code submitted through FetchPaperwork is encrypted, tied to an active sign-in attempt and expires after two minutes. In secure-browser mode, the code is entered only into the live browser. A provider may accept a saved session without asking for MFA on every collection.
AI repair and your login
Routine collection uses deterministic browser instructions. Automatic repair can use filtered navigation information to suggest a new route. Saved credential records, cookies and verification codes are excluded from the repair request; the browser applies your login separately. A proposed route must pass an isolated invoice check before use.
Retained browser sessions expire
After a successful secure-browser sign-in, FetchPaperwork may retain only the authenticated browser-session cookies needed for later collection. They are encrypted with the same workspace-and-website binding as other secrets and have a FetchPaperwork maximum lifetime of 30 days; the supplier can expire them sooner. Removing the website clears the active copy. We do not retain the password simply because a session is retained.
Your FetchPaperwork account is separate
Managed authentication protects your FetchPaperwork sign-in. Workspace authorization and database row-level policies separate customer data. Saved supplier passwords, sessions and storage tokens are excluded from account responses, receipt exports and agent tools. Use a unique FetchPaperwork password, and a dedicated billing-only supplier account with the minimum permissions needed whenever the supplier supports one.
Your cloud drive is not ours to browse
Your cloud password never reaches FetchPaperwork, and each storage provider enforces a deliberately narrow permission boundary. Google Drive uses drive.file, which limits us to files we create or files you explicitly make available. Dropbox lets us read metadata and write invoices, but we do not request files.content.read, so we cannot download the contents of your existing documents. OneDrive requests Files.ReadWrite so the connection works with both personal and work/school Microsoft accounts. Microsoft therefore grants a broader file permission than our delivery path uses; FetchPaperwork itself confines invoice delivery to its own app-root folder and does not browse your existing document library. We design access around the invoice-delivery job, and you can revoke Microsoft access separately.
What happens when you remove access?
Removing a website stops new collection and clears its saved login, browser session and one-time code from the active application database. Workspace deletion also clears stored cloud and email-discovery connections. Pausing alone keeps the saved login for later. An already-started operation may finish; removal is not a remote sign-out from the supplier. You can revoke provider access or change your supplier password separately.
Backups, privacy and security limits
Removal from the active database does not instantly erase older backups. Backup copies and managed sign-in accounts have separate retention; contact support for a complete erasure request. Never send passwords or verification codes in a support message. No service is risk-free, and we do not claim an independent security certification or penetration-test result.