What Reveal can see, and what it can't.

Overview

Reveal connects only to sources a client approves, retrieves financial evidence from them, and gives the practice that evidence with its context. Never the underlying mailbox, supplier account or drive.

Ask about thisCan my accountant browse my inbox?What happens to documents received through WhatsApp?Which SharePoint locations can Reveal access?

Connected sourcesPUBLISHED

Email access — Gmail, Outlook / Microsoft 365, Yahoo Mail, AOL Mail and IMAP

Reveal connects to email to retrieve financial evidence. It can't send, modify or delete messages. Relevant evidence is surfaced into Reveal; your accountant is not given a general inbox browser.

ProviderHow it connectsReveal can

GmailGoogle OAuthRead the mailbox, read-only

Microsoft 365 / OutlookMicrosoft authenticationRead mail, read-only

Yahoo MailYahoo-family provider authenticationRead mail

AOL MailYahoo-family provider authenticationRead mail

IMAP / compatibleMailbox or app credential, IMAP over TLSRead only; never uses SMTP

Ask about thisCan my accountant browse my inbox?Can Reveal send emails from my mailbox?What does read-only mean?

Connected sourcesPUBLISHED

Supplier portal access

Supplier portals don't offer read-only connections the way email providers do. To retrieve invoices, Reveal signs in to the supplier account with the client's approval. That login is protected as carefully as a mailbox permission, and the practice never gets a browser into the account.

• Credentials are never displayed through Reveal
• A rejected supplier password is deleted immediately
• The stored supplier credential is deleted on disconnect
• If the supplier asks for a one-time code, Reveal asks you for it. It's used for that sign-in only and isn't kept

1. 01Client connects the supplier accountSigns in with the supplier, with their approvalCLIENT↓
2. 02Sign-in encryptedHeld separately from product data and never displayedENCRYPTED↓
3. 03Reveal retrievesOnly supported financial documents, such as invoices and receiptsREVEAL↓
4. 04Financial evidenceLinked to the payment, with source and timeEVIDENCE↓
5. 05Accounting workflowThe practice sees evidence. Never the login, never the accountPRACTICE↓

Ask about thisWhy does Reveal need my supplier password?How is my supplier password protected?Can my accountant see my supplier password?

WhatsApp Business

Reveal connects to a WhatsApp Business account through the WhatsApp Business Platform. It never logs in to personal WhatsApp. The business connects explicitly, and receipts or invoices sent to that business number can feed Reveal as evidence.

1. 01Connected WhatsApp Business accountConnected explicitly by the businessCLIENT↓
2. 02Business message or documentA supplier sends a receipt or invoiceSENDER↓
3. 03Provider eventDelivered by the WhatsApp Business PlatformPROVIDER↓
4. 04RevealReads the document and its contextREVEAL↓
5. 05Financial evidenceJoins the financial storyEVIDENCE↓

Ask about thisDoes Reveal read my personal WhatsApp?What type of WhatsApp account does Reveal connect to?What happens to documents received through WhatsApp?

Connected sourcesPUBLISHED

OneDrive

A Microsoft Graph connection with a read-only, least-privilege approach. Connect the locations where financial evidence lives; Reveal retrieves supported evidence from those approved locations. It doesn't need edit or delete rights.

1. 01Connect MicrosoftThe client signs in with MicrosoftCLIENT↓
2. 02Approve the locations where evidence livesThe smallest useful scopeCLIENT↓
3. 03Reveal reads supported filesRead-onlyREVEAL↓
4. 04Financial evidenceSurfaced with its sourceEVIDENCE↓

Ask about thisCan Reveal see my entire OneDrive?Which SharePoint locations can Reveal access?Can Reveal edit or delete my files?

Connected sourcesPUBLISHED

SharePoint

Give Reveal access to the smallest useful area. An authorised Microsoft administrator approves a specific SharePoint site, and Reveal gets read-only access to that site, not the whole organisation.

Ask about thisCan Reveal see my entire OneDrive?Which SharePoint locations can Reveal access?Can Reveal edit or delete my files?

Uploads

Documents added directly by the client or the practice join the same financial story, carrying who uploaded them and when.

Ask about thisCan my accountant browse my inbox?What happens to documents received through WhatsApp?Which SharePoint locations can Reveal access?

Access & visibility

Source access is not practice visibility. Reveal may need enough technical access to a connected system to retrieve evidence. That doesn't give the accounting practice access to that system.

1. 01Connected sourceEmail, supplier portal, WhatsApp Business, OneDrive, SharePointSOURCE↓
2. 02Approved technical accessOAuth, encrypted credential or approved location, as each source requiresBOUNDARY↓
3. 03Reveal processingRetrieve, read, associate, explainREVEAL↓
4. 04Relevant financial evidence and contextDocuments, payment, timing and reasonsEVIDENCE↓
5. 05Accounting practiceNo mailbox browser, no supplier login, no drive explorerPRACTICE↓

Ask about thisCan my accountant browse my inbox?Can my accountant see my supplier password?Can Reveal employees access my information?

Reveal personnel access

Customer information may be accessed by authorised Reveal personnel where necessary to operate, support or secure the service. Access uses individual identities, multi-factor authentication and role-based controls, and sensitive access is recorded.

• A separate identity for every authorised staff member
• Multi-factor authentication enforced
• Role-based access controls
• Every sensitive customer-data read logged against the individual
• Detailed technical controls are in Reveal's security pack, available on request from hello@revealos.com.

Ask about thisCan Reveal employees access my information?How is staff access controlled?Is sensitive access logged?

Credential protection

Connection credentials and access tokens are encrypted before storage, decrypted only when needed to connect to an approved source, and never displayed back through the product.

• Credentials are held separately from evidence and product data
• Stored credentials are deleted when a source is disconnected
• Detailed technical controls are in Reveal's security pack, available on request from hello@revealos.com.

Ask about thisHow are mailbox tokens encrypted?How is my supplier password protected?Where is my data stored?

Encryption

Connections between Reveal, users and connected providers use encrypted transport such as TLS. Credentials and tokens are encrypted with AES-256-GCM before storage.

Ask about thisHow are mailbox tokens encrypted?How is my supplier password protected?Where is my data stored?

Authentication & privileged access

Practice users sign in with a passwordless magic link. Reveal staff and infrastructure accounts use multi-factor authentication, and production access follows least privilege.

Ask about thisCan Reveal employees access my information?How is staff access controlled?Is sensitive access logged?

Practice isolation

Information is scoped to the practice and client workspace it belongs to: clients, connections, evidence and ledger links. Internal privileged access is controlled separately.

Ask about thisIs my practice's data kept separate from other practices?Where is my data stored?Is Reveal SOC 2 or ISO 27001 certified?

Data lifecycle

Follow a piece of evidence from connection to deletion. Choose a stage to see what's involved.

Ask about thisIs my practice's data kept separate from other practices?Where is my data stored?Is Reveal SOC 2 or ISO 27001 certified?

Retention & deletion

Disconnecting and deleting are different things, so here they are side by side.

• Disconnecting stops future retrieval and deletes the stored credential or token. Evidence already retrieved remains available to the accounting practice until the practice instructs Reveal to delete it or the applicable retention period expires.
• If you created an IMAP app password, revoke it with your email provider too.

Ask about thisIs Reveal a Controller or Processor?Which companies process my information?How do I ask Reveal to delete client information?

Auditability

Important access and actions leave a trace.

• Source connected or disconnected
• Evidence retrieved
• Document viewed or downloaded
• Matching and association decisions
• Ledger actions
• Privileged and administrative access, attributed to the individual

Ask about thisCan Reveal employees access my information?How is staff access controlled?Is sensitive access logged?

AI & model processing

Reveal is AI-native, and we explain what AI does and where your information goes. It reads documents, extracts data, understands evidence, associates and matches it, assists supplier-portal navigation, explains its reasoning, powers Ask Reveal and keeps working in the background.

• Reveal does not train cross-customer Reveal models on client information unless separately authorised.
• External model providers' retention and training settings are disclosed separately, below.

Ask about thisIs my data used to train AI models?What happens when Reveal is unsure?How does Reveal decide evidence belongs together?

Subprocessors

The companies that process information on Reveal's behalf. Reveal assesses each provider before customer data is routed through it. The full register, with what each receives, retention and transfer safeguards, is in the Data Processing Agreement and available on request.

• International transfers are covered by Standard Contractual Clauses with the UK Addendum, or equivalent safeguards
• Not treated as subprocessors: Google, Microsoft, Yahoo/AOL and connected accounting systems, when they are the source or destination the customer chose. Stripe acts separately for Reveal billing.

Ask about thisIs Reveal a Controller or Processor?Which companies process my information?How do I ask Reveal to delete client information?

Security operations

What's in place to run Reveal securely. Reveal doesn't claim certifications it hasn't confirmed. Report a security concern to the privacy and compliance contact, hello@revealos.com.

• Detailed technical controls are in Reveal's security pack, available on request from hello@revealos.com.

Ask about thisIs my practice's data kept separate from other practices?Where is my data stored?Is Reveal SOC 2 or ISO 27001 certified?

UK GDPR

The accounting practice generally acts as Controller for its client processing. Reveal acts as Processor when processing client information on the practice's instructions, and separately as Controller for its own account and billing information. This is a summary, not legal advice.

Ask about thisIs Reveal a Controller or Processor?Which companies process my information?How do I ask Reveal to delete client information?

Review our documentation

Formal legal documents live on app.revealos.com. Reveal's security pack (technical controls, data flows and the full subprocessor register) is available on request.

Ask about thisIs Reveal a Controller or Processor?Which companies process my information?How do I ask Reveal to delete client information?