Docs/Security & Privacy
Reference

Security & Privacy

How ReceiptConverter handles your API keys, receipt images, and extracted data — whether you're using the dashboard, the API directly, or the MCP server.

API key security

Keys are yours
Your API key is generated on your account and only shown once. ReceiptConverter never stores the raw key after generation — only a hashed version for validation.
Keys live on your machine
When using the MCP server or direct API, your key stays in your local config file or environment variable. It is never sent to any third party — only to receiptconverter.com/api/v1/convert in the Authorization header.
HTTPS only
All API traffic is encrypted in transit via TLS. There is no HTTP fallback.
Revoke anytime
You can revoke any API key instantly from your dashboard. Revoked keys stop working immediately.

Receipt image & data handling

Images go through OpenAI
Receipt images are sent to OpenAI's API (GPT-4 Vision) for text extraction. OpenAI's data processing policies apply. OpenAI does not use API-submitted data to train models by default. See openai.com/enterprise-privacy for details.
No data sold or shared
ReceiptConverter does not sell, share, or monetize your receipt data or extracted fields. Your data is used only to return the structured JSON response to you.
Storage is opt-in
When using the dashboard, converted receipts are stored to your account so you can access them later. Via the API, data is not stored by default — the response is returned and discarded unless you explicitly save it.
Multi-language receipts
Receipts in any language are supported. The extracted data is always returned in standardized English field names regardless of the source language.

MCP server security model

The receiptconverter-mcp package is a thin bridge that runs locally on your machine. Here's exactly what it does and doesn't do:

Runs locally
The MCP server process runs on your machine, not on ReceiptConverter's servers. It reads your API key from your local config, makes one POST request to the API, and returns the response.
No telemetry
The package does not collect usage data, analytics, or error reports. It has no outbound connections other than the API call you explicitly trigger.
Open source on npm
The published package code is visible at npmjs.com/package/receiptconverter-mcp. You can inspect every line before running it.
Minimal dependencies
The package has exactly one dependency: @modelcontextprotocol/sdk. No analytics libraries, no HTTP clients beyond Node's built-in fetch.
Your key, your quota
Every user runs the MCP server with their own API key. ReceiptConverter never sees usage aggregated across users — each key is independent.

CORS & browser usage

CORS is enabled on the API, so browser-based apps can call it directly. However, do not embed your API key in client-side code — it will be exposed to anyone who inspects your app. Use a server-side proxy to keep the key private.

Reporting a vulnerability

If you discover a security issue, please email hello@receiptconverter.com directly rather than opening a public issue. We take security reports seriously and respond within 48 hours.