Security & privacy at Karchu
This page is maintained by the Karchu team to answer the security and privacy questions builders and finance leads usually ask before uploading their first statement. It describes controls that are currently enabled in the product. It is not a certification, an audit report, or a legal document - for a formal security review, contact us and we’ll work through your questionnaire.
Authentication and access
- Passwordless-friendly sign-in. Karchu supports email + password and Google OAuth. Sessions are stored in your browser and can be revoked from Settings.
- Workspace roles. Every organization has explicit roles - owner, manager, accountant, analyst, employee, viewer - with per-view access. New members join by invitation only.
- Server-verified role checks. Sensitive operations re-check permissions on the server, not just in the UI, so a modified client cannot escalate privileges.
Data storage and isolation
- Workspace-scoped queries. Every database read is scoped to your organization at the row level. A user in one workspace cannot read another workspace’s transactions, receipts, or rules - the isolation is enforced by the database, not by application code alone.
- Encryption in transit. All traffic between your browser and Karchu is served over HTTPS/TLS.
- Managed infrastructure. Karchu runs on a managed cloud backend that provides encryption at rest for the database and file storage layers.
Parsing and file handling
CSV and Excel statements are parsed in your browser before you save anything. That means the raw file contents don’t need to leave your device unless you deliberately choose to upload them into your private vault. PDF statements are processed through a parsing pipeline that extracts tabular data; scanned PDFs use on-device OCR. Extracted transactions land in your workspace only after you confirm the import.
What we collect and why
The full list lives on our privacy page. In short: account identifiers so you can sign in, the financial files you choose to upload, the transactions extracted from them, workspace metadata (organization, members, roles), and minimal operational data (error reports, usage counters) used to enforce plan limits. We do not sell your data. We do not train third-party AI models on your data.
Payments and PCI scope
Paid plans are billed through Stripe. Karchu never sees or stores your card number, CVC, or expiry - those fields live inside Stripe’s hosted checkout. This keeps Karchu out of PCI scope for cardholder data.
Data deletion
You can delete individual documents, receipts, or transactions from within the app at any time. To delete your entire account or an organization, email us at hello@karchu.com from the address on the account. We remove account data from active systems within a reasonable window; short-lived backups age out on their normal rotation.
Reporting a vulnerability
If you believe you’ve found a security issue, please email hello@karchu.com with steps to reproduce. Please do not publicly disclose the issue until we’ve had a chance to respond. Our published contact for coordinated disclosure lives at /.well-known/security.txt.
Shared responsibility
Security is a partnership. Karchu is responsible for the platform controls described above. You are responsible for choosing a strong password, keeping your account credentials safe, managing who you invite into your workspace, and reviewing the roles you grant them. If you handle client financial data, we recommend a dedicated workspace per client and the least-privilege role that still lets each teammate do their job.
Questions
If you’re evaluating Karchu for a business that needs a formal security review, get in touch through the contact page and we’ll work through your questionnaire.