🔒 How secure are my medical receipts?

Files are stored encrypted in Cloudflare R2 and served only through authenticated requests. We never sell or share your data.

Medical receipts are sensitive, and the storage model reflects that:

  • Encrypted at rest in Cloudflare R2 object storage
  • Encrypted in transit over TLS on every request
  • Authenticated access only — files are not served from public URLs, and there is no guessable path to your documents
  • Scoped to your account — every request is checked against the signed-in user
  • Never sold, never shared, never used for advertising

You can delete everything at any time, and export everything at any time. Both are one click and neither requires talking to anyone.

Full details in the privacy policy.

One honest note on scope: SaveMyHSA is a document vault, not a HIPAA-covered entity. It stores what you upload; it doesn't exchange records with providers or insurers.

Related