Vetrix
Back to Home

Privacy Policy

Last updated: July 16, 2026

1. Overview

Vetrix (referred to as "we", "us", or "our") is a multi-tenant back-office operating system designed for construction subcontractors. We provide accounts payable (AP) automation, accounts receivable (AR) tools, and job-costing workflows.

Vetrix acts as an ingestion and workflow management layer. QuickBooks Online remains your official financial system of record. This Privacy Policy explains how we collect, process, secure, and share information when you connect your QuickBooks company file and use our services.

2. Information We Collect

To automate your financial back-office operations, we collect and process the following categories of information:

  • Account Credentials & Org Profiles: Names, email addresses, roles, and organization names collected through Supabase Auth during registration.
  • QuickBooks Connection Metadata: OAuth connection states, Realm IDs, and secure tokens required to communicate with your QuickBooks Online company account.
  • Invoice Files & Metadata: Vendor invoice PDFs delivered via Postmark inbound email or direct upload, including extracted vendor details, amounts, line items, job names, and cost code identifiers.
  • Audit Logs: Granular records of AI agent transactions, processing details, and manual human overrides in the review queue.

3. Data Security & Storage Isolation

We protect your financial data through rigorous architectural controls:

  • Tenancy Isolation: All databases are hosted on Supabase Postgres and isolated strictly using PostgreSQL Row-Level Security (RLS) policies. Every table operation is constrained to the verified org-membership of the active session.
  • Token Encryption: All QuickBooks access and refresh tokens are encrypted at the application layer using AES-256-GCM prior to storage at rest. Decryption occurs only at runtime within isolated worker steps.
  • File Protection: Invoices are stored in private Supabase Storage buckets. Direct access is prohibited; the user interface references only temporal signed URLs with a 60-second Time to Live (TTL).
  • Transit Encryption: All internal and external network connections use HTTPS (TLS 1.3).

4. QuickBooks Online Data Access

When you connect Vetrix to QuickBooks Online, you grant us access to the com.intuit.quickbooks.accounting scope. We access only the endpoints necessary to:

  • Retrieve lists of active Vendors, Jobs (Classes), and Cost Codes (Expense Accounts) to run our automated matching and matching heuristical logic.
  • Post approved transactions to QuickBooks Online as "Bills" or update historical connection sync dates.

We never perform autonomous ledger modifications outside your explicit approval triggers or your organization's configured auto-approval thresholds.

5. Third-Party Service Providers

We partner with trusted service providers to deliver our infrastructure. We do not sell your personal or financial data to anyone.

  • Supabase: For cloud hosting, Postgres database management, storage, and authentication services.
  • Inngest: For resilient, step-retryable background queue and sync workflows.
  • Stripe: For subscription billing processing and payment profile management.
  • Postmark: For inbound parsing of vendor invoice emails.
  • Google (Gmail): For outbound email delivery, including in-app notification emails and accounts-receivable payment reminders sent to your customers. These emails can include invoice references and amounts.
  • Vercel & Anthropic: For web page serving and private, secure Vision LLM extraction.
  • Sentry: For error diagnostics. When something breaks, the error report can include your organization identifier and the request that failed; it never includes invoice documents or QuickBooks credentials.

6. Cookies

Vetrix sets only the cookies the product needs to function. We use no advertising, analytics, or cross-site tracking cookies, which is why you don't see a cookie consent banner.

  • Authentication (strictly necessary): Supabase session cookies (sb-*) keep you signed in. Removing them signs you out.
  • Active organization (functional): vetrix-active-org remembers which of your organizations you are working in. It is set only when you use the organization switcher and is cleared on sign-out.

7. Data Residency

Your database records and invoice documents are stored in Supabase's Tokyo region (AWS ap-northeast-1, Japan). Application code runs on Vercel's global edge and serverless network, and the subprocessors listed above process data in their own regions (Stripe, Postmark, Google, Anthropic, and Sentry operate primarily from the United States). If you need data processed in a specific region for regulatory reasons, contact us before onboarding.

8. Data Retention & Deletion

We retain your data for as long as your subscription is active. To request deletion of your Vetrix organization's data — including QuickBooks connection tokens, transaction records, and invoice PDF attachments — contact us at privacy@vetrix.com. We will verify the request and carry out the deletion from our active datastores within 30 days.

9. Contact & Support

For security audits, data access requests, or privacy inquiries, please contact us at:

privacy@vetrix.com