Security at Fair Bill Analyzer
The short version: your invoice is read in your browser, the checks run on your device, nothing is sent anywhere unless you approve a redacted copy, and we do not keep your invoice.
How your invoice is handled
- Your PDF is read in your browser. It is never uploaded to us as a file. Pasted text stays in your browser too.
- The math and duplicate checks run on your device. They work even with your internet turned off.
- Identifying details are removed before anything can leave. Names, firm names, case numbers, addresses, and account numbers are replaced with placeholders. If the review finds something it cannot safely remove, such as what looks like a child’s name, it stops and sends nothing.
- You see every replacement and decide. Only if you approve is the redacted line text sent, for one optional step: AI-written observations. If you decline, the checks still run and nothing is sent.
- Closing the tab ends the review. We do not keep a copy of your invoice or your results.
What we never receive
- Your invoice file
- The names, case numbers, addresses, or account numbers the review removes
- Your card number (payments are handled entirely by Stripe)
- Invoice text or dollar findings in our analytics
What we keep
- Payments: Stripe keeps the payment record. Before unlocking the written instruments, our server confirms with Stripe that the payment went through.
- Email: We do not keep a separate list of customer emails. Stripe keeps the email you enter at checkout for your receipt.
The companies involved
| Company | What it does for us | What it receives |
|---|---|---|
| Google Firebase | Hosts the website and our small server | Normal web requests |
| Google Gemini (Gemini 2.5 Flash) | Writes the optional AI observations | Redacted line text, only after you approve it |
| Stripe | Takes the $29 payment | Your payment details and email, entered on Stripe’s own page |
| Google Analytics | Counts visits and review steps | Counts and yes/no values only; analytics cookies only if you allow them |
| Google Ads | Measures whether ads led to visits | Only if you allow cookies |
| CookieYes | Runs the cookie choices banner | Your cookie choice |
Protections in place
- Encrypted connections (HTTPS) on every page.
- The AI endpoint only accepts requests from our own site and limits how often it can be called.
- The redaction check blocks sending when identifiers remain.
- Payment is verified with Stripe on our server, not trusted from the browser.
- The admin area requires sign-in with an administrator account and is hidden from search engines.
What we do not claim
- No SOC 2 or similar certification yet. We describe how the system actually works instead.
- No zero-retention agreement with our AI provider. Redacted line text sent for the optional AI step is processed under Google’s standard terms for its paid API. Remove anything you do not want processed.
- Redaction can miss things. Review the redacted copy yourself before approving.
- This is not a law firm, and using the tool does not create an attorney-client relationship or privilege.
Report a security concern
Email chris@fairbillanalyzer.com. We read every report and respond. For the full policy, see the Privacy Policy.