Skip to content

Expense Management Security

Security and compliance built for finance teams

Capture Expense is Cyber Essentials certified, ICO registered, and hosted on Azure, with single sign-on, multi-factor authentication, and a full audit trail on every action.

Book a demo Talk to us

Certified and registered

ICO registered and GDPR compliant

Capture Expense is registered with the Information Commissioner's Office and processes personal data under UK GDPR.

Certified against Cyber Essentials

Capture Expense holds Cyber Essentials certification, the UK Government scheme for baseline cyber security controls.

Available through G-Cloud

Capture Expense is listed as a G-Cloud supplier, so public sector bodies can buy it through the G-Cloud framework without a separate procurement process.

Overview

What protects your data every day

  • Single sign-on and MFA

  • Role-based access

  • Data isolation

  • Controlled AI access

  • Lost device control

  • Full audit trails

  • Human approval retained

  • Backups and continuity

  • Continuous security testing

Data controls

Data handling and access

Storage and encryption

Data stored on Azure

All customer data is hosted on Azure infrastructure located in the UK.

  • Encrypted in transit using TLS 1.2 or higher
  • Encrypted at rest using AES-256
  • Held for the period set out in your organisation's data retention policy, then deleted
  • Isolated per customer account, so one organisation cannot query another's data

Access control

Access controlled by role, not by default

Every user signs in through single sign-on with multi-factor authentication and sees only what their role permits.

  • Role-based access control limits visibility by job function, not by request

  • Lost device control lets an admin revoke access to a stolen or misplaced phone from the console

  • Full audit trail records every login, edit, and approval, with a timestamp and user ID attached

Continuity and testing

Backed up, tested, and ready for audit

Platform data is backed up on a schedule, with a continuity plan for outages.

  • Backups run on a fixed schedule, with continuity plans covering platform outage
  • Continuous security testing checks for new vulnerabilities on an ongoing basis, not once a year
  • Statutory audit support gives your auditor the trail they need, in the format they need it
  • VAT ready records keep receipts and mileage claims in a format your VAT return and HMRC can use directly

AI controls

Read only, controlled AI access

What the AI can see

AI reads expense claim data to extract, categorise, and flag it against policy. It does not edit, delete, or export records on its own.

What stays under your control

Every AI action appears in the same audit trail as human actions, with the same timestamp and record detail.

Security & compliance FAQs

Is Capture Expense GDPR compliant?
Yes. Capture Expense is registered with the ICO and processes personal data under UK GDPR. A data processing agreement is available on request.

Where is data stored?
All data is hosted on Azure. It is not stored or processed outside the UK.

How is receipt data protected?
Receipt images and the data extracted from them are encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Access is limited by role, and every view or edit is recorded in the audit trail.

Does Capture Expense support DVLA checks?
Yes. The platform supports DVLA checks for employees claiming business mileage in their own vehicle.

What happens if an employee loses their device?
An admin can revoke access to a lost or stolen device from the admin console. Access is cut off immediately, without waiting for IT to reissue a phone.

Is Capture Expense suitable for public sector buyers?
Yes. Capture Expense is a registered G-Cloud 15 supplier, so public sector bodies can buy it through the G-Cloud framework.

Does Capture Expense support statutory audits?
Yes. The platform provides statutory audit support, giving auditors direct access to the audit trail and underlying records.

Are VAT records kept in a usable format?
Yes. Every receipt and mileage claim is stored as a VAT ready record, in a format your finance team and HMRC can use without reformatting.

What happens to our data if we leave?
You can export everything, including receipts and the full audit history, at any time. On termination your data is deleted in line with our retention policy and contract.

Can we complete a security questionnaire?
Yes. We regularly complete customer due diligence questionnaires and have supported tenders for public sector, legal, and financial services organisations. Ask your account manager or sales contact.

Can't find what you're looking for? Talk to us and we'll answer within a working day.

Explore more of the platform

Talk to us about your expense management security

Book a demo
Free trial Book a demo