Account boundaries
API routes require an account session. Client records, invoice captures, runs and payment records are queried by the signed-in account. Local accounts use salted PBKDF2 password hashes and random session tokens.
Uploaded files
Reconciliation uploads are limited to 20 MB per file, parsed in memory and not retained. OCR scans are processed locally; extracted fields are saved in the local SQLite database for review.
Protect your workspace
- Use a strong password and keep access to your computer and browser profile private.
- Back up the VyaraRecon database using a secure location you control.
- Keep the app and its dependencies updated.
- Only upload records you are authorized to process.
Third-party services
Google sign-in and payment-provider services are used only when enabled in the application. Their own privacy and security terms apply when used.