Do I need to connect my bank?

No. EXPOZOR is designed to work without bank connections. Manual entry, mapped CSV import, recurring review, and monthly summaries are available in the app.

Does EXPOZOR collect my bank login?

No. EXPOZOR does not require or collect bank login credentials of any kind.

Does EXPOZOR move, hold, or transfer money?

No. EXPOZOR is only for tracking and understanding expenses. It does not move, custody, transmit, or manage funds.

Is EXPOZOR financial advice?

No. EXPOZOR provides organization, categorization, and spending insights for informational purposes only. It does not provide financial, investment, tax, legal, accounting, credit, or professional advice of any kind.

Can AI or OCR make mistakes?

Yes. AI/OCR features are planned as assistive tools and may be inaccurate. Users should always review and edit extracted or categorized data before relying on it.

Can I export or delete my data?

Yes. Signed-in early-access users can download expense CSV or a complete JSON workspace export, review active sessions, and permanently delete their account from Privacy & Data. Waitlist-only deletion requests can still be sent through the Contact page.

Mapped CSV import is live in the app. Receipt images and transaction screenshots are not live yet and remain planned; manual entry remains available.

What happens if I cancel?

Billing is not live yet and no payments are collected from the waitlist. If you join early access, you can contact support to request waitlist data changes or deletion.

All posts

Security

EXPOZOR's Security Philosophy: Privacy by Architecture

Financial data is sensitive. Here is the conservative security posture behind EXPOZOR's manual early-access workspace.

MOHAMED KARRACH· Founder

May 20, 20262 min read

Start with what is real

EXPOZOR operates a public waitlist and an early-access signed-in workspace. The public flow stores waitlist signup data. The workspace stores account information and the expenses, categories, budgets, recurring records, and imports that a user chooses to create.

CSV files are parsed in the browser before import. The application server receives only the normalized rows and fields you approve during review; the original file and ignored columns are not uploaded by the import flow. Approved transaction rows and import metadata are stored. Receipt images and screenshots are not currently supported.

HTTPS and browser protections

The web app is configured with HTTPS, HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers.

These controls do not replace a full production security program, but they are real controls in the current app configuration.

No bank credentials

EXPOZOR does not ask for, collect, or store bank credentials, passwords, PINs, or bank-connection tokens. Manual expense entry and mapped CSV import do not require a connection to a financial institution.

Expense tracking only

EXPOZOR is not a bank or payment service. It does not access accounts, custody funds, or initiate payments. Shared household expense tracking is planned as manual notes only.

Analytics and tracking

No analytics provider is currently active in the codebase. If analytics are added later, they should be disclosed on the Subprocessors and Cookie Policy pages before launch.

Your data, your choice

Signed-in users can download a complete JSON export, download expense CSV, review active sessions, and permanently delete the account from Privacy & Data. Waitlist-only deletion requests remain available through the privacy contact address.

Responsible disclosure

If you find a security vulnerability, email security@expozor.com with a description of the issue and steps to reproduce.

What EXPOZOR is working toward

Passkeys or multi-factor authentication, client-side import parsing, and encrypted portable backups are the next major account-security milestones. Confirmed subprocessors and user controls remain documented on the legal and security pages.