Financial rows stay local by default. Remit accounts are separate.
Browser-based is not the same as no data collection. Here is the boundary of the current release.
Financial files and decisions
Selected receipt, invoice and remittance CSVs are parsed in page memory. Deterministic matching does not upload their rows or save them in localStorage. Decisions, payer confirmations and request drafts remain in the current tab unless you explicitly download supported work. Refreshing, closing, signing out or changing the active account/organisation clears the workspace. There is no cloud recovery for this financial session.
The authenticated workspace offers an explicit encrypted checkpoint download containing source rows, mappings, decisions and recovered drafts—not unsaved form notes. Encryption and decryption happen in your browser with your passphrase. No checkpoint file or passphrase is uploaded. We cannot recover a forgotten passphrase. Restoring requires the same active Remit account, fresh payer confirmation and fresh decision approval; the file is not proof of original approval or current invoice balances.
Independent Remit accounts and hosting
remit-match.provhq.com uses its own Clerk application for authentication and account/session information. ScopeMentor has a separate login and account database; a session there does not grant Remit access. Vercel serves the site and may process request metadata such as IP address, browser information and route. Imported financial content is separate from account information.
The separate Remit database holds an optional display name, hashed identity/access bindings and content-free grant and usage records. The account page offers profile changes, account-record export and confirmed product profile/access deletion when that database is available. Deletion removes the optional profile and revokes product access, but retains minimal identity hashes, access tombstones, grant provenance and usage records for access control and charge reconciliation. It does not delete your Clerk login, cancel billing or remove downloads. Contact server@ateliermdt.com for separate identity, billing or privacy requests; do not attach financial source files.
Optional selected-case AI
AI assistance is disabled until Remit's paid grant, quota and provider controls are connected. Checking availability sends no financial content. If enabled, each request requires a local preview and your explicit consent to send one receipt, selected invoice/remittance rows and an optional excerpt through the Remit server to OpenAI. No full-file or automatic AI upload occurs.
The adapter requests no stored response, but that is not a zero-retention guarantee: provider abuse-monitoring retention may apply. You can decline AI and continue deterministic/manual review. No financial session replay or advertising pixels are added.
Browser and device limits
The product subdomain is a separate browser origin from ScopeMentor and the public ProvHQ site. This is not a claim of complete isolation from shared parent-domain cookie risks, browser extensions, a compromised device or scripts executing inside Remit. We do not claim end-to-end encryption, zero knowledge or a compliance certification. Use a trusted browser profile and authorised source exports.
Exports and older saved work
Ordinary CSV, readable report, audit JSON and account exports are not encrypted and may contain financial or account records. Only the explicitly labelled encrypted checkpoint uses passphrase encryption. All downloads remain on your device under your control; the app cannot delete them, including after product-access deletion. Protect the files and keep checkpoint passphrases separately. An older saved workspace, if present on this origin, is not automatically loaded; an explicit control removes that exact legacy key only. Old data on the former ProvHQ origin is not accessible to this subdomain. Retain original files and exports before clearing browser data.