Sensitive documents. Serious protection.
Claim files and expense receipts hold personal and financial details. Assaya keeps them locked down, and keeps a record of every decision that can't be quietly rewritten.
How your documents are protected
Originals stay untouched
Every document is stored exactly as received, on write-once storage. Nobody can alter it.
Encrypted with your own key
Every document, finding, note and decision reason is encrypted before it's stored, with keys for each case, locked by an encryption key dedicated to your company. Every use of that key is logged.
Deleted for good, with proof
Delete a case, a claim or everything, or let closed cases expire after a period you set. Deletion destroys the encryption keys, so no copy can be read, and you get a signed certificate.
Malicious files are contained
Each file is opened in isolation, so a damaged or harmful document can't touch anything else.
Every action is on record
Who did what, and when. Any later attempt to edit that record is detected.
People make the decisions
Assaya never denies a claim or rejects a receipt. Approving a high-risk document takes a written reason.
Changes are proven first
Any change to scoring runs silently on real documents before your team sees it.
Your cloud or ours
Use Assaya as a hosted service, or run it in your own cloud account.
Common questions.
Where is our data stored?
In the region you choose, either in Assaya's hosted service or in your own cloud account.
Is our data encrypted?
Yes, twice over. In transit, every connection uses TLS 1.3, including those inside the service, with post-quantum key exchange wherever your browser or system supports it. At rest, Assaya encrypts every document, page image, extracted value, finding, note and decision reason itself before storing it (AES-256), using a separate key for each case. Those keys are locked by an encryption key dedicated to your company, and every use of it is logged. The disks and storage underneath are encrypted again with the same key. Matching across cases, such as the same invoice number or bank account, works without decrypting the values.
Who can see our documents?
Only the people you give access to. Every view and decision is recorded.
How long do you keep documents?
As long as you choose. Closed cases are deleted automatically after the period you set; cases on legal hold are kept; and a document sent by mistake, a finished pilot or everything can be deleted on request. Deleting destroys the case's encryption keys, so the data can't be read anywhere, and backups age out within 30 days. Each deletion comes with a signed certificate.
Does Assaya make claim or reimbursement decisions?
No. It flags documents and explains why. A person on your team always decides.
Our receipts come from employees. What about their data?
Receipts are checked in your own Assaya environment, encrypted, kept only as long as you choose, and deleted with a certificate when they go. Assaya scores documents, not people: it doesn't rate employees or track what they do. Where works-council or employee-monitoring rules apply, bring them in before going live; we'll walk them through what Assaya stores and why.
Do you have independent security certification?
An independent security audit (SOC 2 Type II) is part of the launch plan. We'll share the report when it's complete.
Proof before payout.
See how Assaya highlights suspicious findings, explains what triggered them and gives reviewers what they need to take the next step. A focused 30-minute walkthrough; no sensitive documents required.