How we keep your premium fund account safe.

EasyPFA never connects to your bank, never asks for your bank username or password, and has no bank feed. Everything comes from photos of the deposit reports, bank receipts and bank statements you already handle, or from numbers you type in.

So EasyPFA cannot move, withdraw or hold a cent. It keeps the record; your bank keeps the money.

When you snap a document, your phone sends it over an encrypted connection to our server. The server holds it in memory and asks Anthropic’s AI to read the numbers and suggest black boxes over customer names, policy numbers, full account and routing numbers, addresses, and the payer details on checks.

You check every number and every box: move one, resize it, delete it or add your own. When you confirm, your browser burns the boxes into the image and uploads only that redacted copy. EasyPFA never writes the original to disk, storage, logs or error reports, and if you walk away before confirming, nothing is saved at all.

You don’t have to snap the private parts at all: we only need the numbers, so the bottom of a deposit report and a statement’s summary and transactions are enough. And your agency’s owner chooses whether photos are kept: the blacked-out copy (recommended, so you can look back at it), or none, in which case EasyPFA keeps the numbers you confirm and deletes each photo, along with any already saved.

Anthropic receives the photo only to read it. Anthropic does not train its models on it, and deletes it within 30 days unless it must keep it longer to enforce its usage policy or by law.

We ask for the last four digits of your Premium Fund Account and nothing more, and the software rejects anything longer. When it reads a deposit report, it keeps amounts and counts, not customer names. Long strings of digits, the shape of policy and account numbers, are stripped out of descriptions before they reach your screen.

When you pay, your card number goes to Stripe, our payment processor, and never reaches us.

Every record carries your agency’s ID, and the database itself, not just the app, refuses to hand one agency’s rows to another (Postgres row-level security). Automated tests go table by table to prove that one agency cannot read, change or add to another agency’s data.

Document images sit in private storage. To show you one, the app creates a link that expires after 60 seconds.

Roles are enforced on our server for every action, not just hidden on the screen: the owner runs billing and roles, managers close the books, and staff record deposits.

Once posted, a ledger entry cannot be edited or deleted. The database refuses, even when the request comes from our own server code. A correction is a reversal plus a new entry, so both stay on the record. The one thing that changes on a posted entry is whether it has been matched to your bank statement. That is set when a month is closed, and set aside again only if the agency reopens that month to correct it.

The audit log works the same way. It records log-ins (with IP address and browser), document views, postings and other key actions, and it cannot be edited after the fact.

Each month EasyPFA matches your bank statement to what you recorded, carries forward what is still in transit, and explains any difference in plain English. The report shows the statement's beginning and ending balance, deposits in transit, sweeps outstanding by state, the adjusted bank balance, your book balance and the difference, with signature lines for who reconciled it and who reviewed and approved it, then every transaction marked matched or outstanding.

Closing a month locks it. If the most recent closed month needs a correction, the agency owner (or a manager allowed to close months) can reopen it, with a reason. The signed report it replaces is kept and marked replaced, and the new report says which one it replaces. Reports carry amounts and last four digits only, so they are safe to print, email or hand to an auditor.

Anyone can add a code from an authenticator app to their sign-in, and we recommend it. After the password, EasyPFA asks for the 6-digit code before anything opens, and a sign-in that has not entered it cannot see or change a thing. EasyPFA’s own support access always needs the code.

Too many wrong codes pause sign-in for a while, and every attempt is logged.

Every connection to EasyPFA uses HTTPS. Your data is stored with Supabase in the United States and encrypted at rest, and the app runs on Vercel. The keys to our services live only in server settings, never in the code sent to your browser.

Passwords are stored hashed by our sign-in provider. We cannot read them.

One QR code per office lets staff without a login send a deposit, and nothing else: no records, no history, no other page. An optional 4-digit code, a limit on how often it can be used, and every deposit sent is logged with the network it came from.

By default nothing is recorded until someone logged in to the agency approves it; the owner can choose to let QR deposits be recorded straight away, and each one can still be undone. Make a new QR code and the old one stops working at once.

The owner can download everything at any time: the records as CSV files, the blacked-out photos and every report PDF.

The owner can also delete the agency. Everyone is locked out at once, and deletion finishes within 30 days. If a subscription ends, the records are kept 90 days, read-only, and the owner is emailed two weeks before they are deleted for good.

Analytics and ad measurement run only on the public website, and only with your consent. Once you log in, nothing third-party loads: no analytics, no ad pixels, no outside scripts. Even the fonts come from our own domain.

What we learn about how the app is used stays in our own database.

When something breaks, error monitoring tells us, often before you notice. It runs on our server only, and is set up never to receive images, document contents, what you type or who you are.